CVE-2026-14207

Name of the Vulnerable Software and Affected Versions LifterLMS versions prior to 10.0.10

Description Insufficient input sanitization and output escaping allow authenticated users with a course-editing role or higher to perform Stored Cross-Site Scripting (XSS). The issue occurs because the plugin fails to strip event-handler attributes from a course pricing field before storing and rendering it. This enables an attacker to inject arbitrary JavaScript that executes in the session of an administrator who views the affected course page.

Recommendations Update to version 10.0.10 or later.