Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: LifterLMS 10.0.10 Clear all filters
TI-2026-12055 CVE-2026-14231 · GHSA-hqvc-w7p2-cpm5

LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

Priority MEDIUM 53

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-leve…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-07-30 Fixed in 10.0.10 CWE-200
TI-2026-12036 CVE-2026-14207 · GHSA-rw87-6jm9-frww

LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

Priority MEDIUM 60

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that execu…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00253 Published 2026-07-30 Fixed in 10.0.10 CWE-79