CVE-2026-119098

Name of the Vulnerable Software and Affected Versions LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes versions prior to 10.3.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the answer[] parameter. This requires the attacker to be enrolled as a student in a course with a Content-type quiz question. The injected script executes in the administrator's browser session during the grading workflow when the 'Start a Review' action is triggered for the affected attempt.

Recommendations Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to version 10.3.3 or later.