WordPress plugin
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High7
- Medium11
- Low1
All LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer ≤10.3.2Update to 11.0.0 | CVE-2026-119098 | |
| High7.5 | Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes ≤10.3.1Update to 10.3.2 | CVE-2026-110284 | |
| High8.8 | Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data ≤10.2.1Update to 10.3.0 | CVE-2026-104723 | |
| Medium6.4 | Authenticated (Custom role+) Stored Cross-Site Scripting ≤10.0.9Update to 10.0.10 | CVE-2026-14207 | |
| Medium4.3 | Authenticated (Subscriber+) Information Exposure <10.0.10Update to 10.0.10 | CVE-2026-14231 | |
| Medium6.5 | Authenticated (Custom+) SQL Injection via 'order' Parameter ≤9.2.1Update to 9.2.2 | CVE-2026-5207 | |
| High8.8 | Various Versions - Authenticated (Student+) Privilege Escalation ≤9.1.0Update to 3.41.2 or 4.21.4 or 5.10.1 or 6.11.1 or 7.8.8 or 8.0.8 or 9.0.8 or 9.1.1 | CVE-2025-11923 | |
| High7.5 | Unauthenticated SQL Injection ≤8.0.6Update to 8.0.7 | CVE-2025-52717 | |
| Medium5.3 | Missing Authorization to Unauthenticated Post Trashing ≤8.0.1Update to 8.0.2 | CVE-2025-2290 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤8.0.0Update to 8.0.1 | CVE-2024-13619 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤7.8.5Update to 7.8.6 | CVE-2024-12596 | |
| High7.2 | Authenticated (Admin+) SQL Injection ≤7.7.5Update to 7.7.6 | CVE-2024-7349 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via Shortcode ≤7.6.2Update to 7.6.3 | CVE-2024-4743 | |
| Medium4.3 | Cross-Site Request Forgery ≤7.5.0Update to 7.5.1 | CVE-2024-31363 | |
| Medium5.3 | Missing Authorization via process_review ≤7.5.1Update to 7.5.2 | CVE-2024-0377 | |
| Low3.3 | Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion ≤7.4.2Update to 7.5.0 | CVE-2023-6160 | |
| High7.5 | Insecure Direct Object Reference <4.21.2Update to 4.21.2 | CVE-2021-24562 | |
| Medium5.4 | Stored Cross-Site Scripting <4.21.1Update to 4.21.1 | CVE-2021-24308 | |
| Medium6.1 | Reflected Cross-Site Scripting <4.21.1Update to 4.21.1 | — | |
| Critical9.8 | Arbitrary File Write <3.37.15Update to 3.37.15 | CVE-2020-6008 | |
| Critical9.8 | Stored Cross-Site Scripting via Import <3.35.0Update to 3.35.0 | CVE-2019-15896 |
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer
≤10.3.2Update to 11.0.0
- High7.5Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
≤10.3.1Update to 10.3.2
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
≤10.2.1Update to 10.3.0
- Medium6.4Authenticated (Custom role+) Stored Cross-Site Scripting
≤10.0.9Update to 10.0.10
- Medium4.3Authenticated (Subscriber+) Information Exposure
<10.0.10Update to 10.0.10
- Medium6.5Authenticated (Custom+) SQL Injection via 'order' Parameter
≤9.2.1Update to 9.2.2
- High8.8Various Versions - Authenticated (Student+) Privilege Escalation
≤9.1.0Update to 3.41.2 or 4.21.4 or 5.10.1 or 6.11.1 or 7.8.8 or 8.0.8 or 9.0.8 or 9.1.1
- High7.5Unauthenticated SQL Injection
≤8.0.6Update to 8.0.7
- Medium5.3Missing Authorization to Unauthenticated Post Trashing
≤8.0.1Update to 8.0.2
- Medium6.1Reflected Cross-Site Scripting
≤8.0.0Update to 8.0.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
≤7.8.5Update to 7.8.6
- High7.2Authenticated (Admin+) SQL Injection
≤7.7.5Update to 7.7.6
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤7.6.2Update to 7.6.3
- Medium4.3Cross-Site Request Forgery
≤7.5.0Update to 7.5.1
- Medium5.3Missing Authorization via process_review
≤7.5.1Update to 7.5.2
- Low3.3Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
≤7.4.2Update to 7.5.0
- High7.5Insecure Direct Object Reference
<4.21.2Update to 4.21.2
- Medium5.4Stored Cross-Site Scripting
<4.21.1Update to 4.21.1
- Medium6.1Reflected Cross-Site Scripting
<4.21.1Update to 4.21.1
- Critical9.8Arbitrary File Write
<3.37.15Update to 3.37.15
- Critical9.8Stored Cross-Site Scripting via Import
<3.35.0Update to 3.35.0
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: common questions
Does LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: 2 critical, 7 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerability?
CVE-2026-119098, published Nov 6, 2026: LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer. Severity: Medium (CVSS 6.4).
Is any LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerability listed in CISA KEV?
No. None of the known LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerabilities is currently listed in the CISA KEV catalog.