LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Why it matters now
EPSS 0.03249 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress (LifterLMS): 4.21.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chrisbadgett | LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress | 4.21.1 to before 4.21.1 | 4.21.1 | Patch available | CNA |
- LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress Vendorchrisbadgett Affected 4.21.1 to before 4.21.1 Fixed in 4.21.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:* | before 4.21.1 | Vulnerable | chrisbadgett |
- cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:* Versions before 4.21.1 Vulnerable ·chrisbadgett
Remediation
- Fix · CNA LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress (LifterLMS) Fixed in 4.21.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24308
- 2026-10-03 Alias added: GHSA-3mxr-2h37-xpjx
References
More chrisbadgett Lifterlms vulnerabilities
- TI-2024-12660 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2019-11948 An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. CVSS 3.1CRITICAL 9.8
- TI-2020-04909 LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution CVSS 3.1CRITICAL 9.8
- TI-2025-32767 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-04416 LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 3.1HIGH 8.8
- TI-2024-20735 WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2021-24308 · CVE Program
- CVE-2021-24308 · NVD
- FIRST EPSS
- GHSA-3mxr-2h37-xpjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences