WordPress plugin
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High7
- Medium11
- Low1
All LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes ≤10.3.1Update to 10.3.2 | CVE-2026-110284 | |
| High8.8 | Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data ≤10.2.1Update to 10.3.0 | CVE-2026-104723 | |
| High8.8 | Various Versions - Authenticated (Student+) Privilege Escalation ≤9.1.0Update to 3.41.2 or 4.21.4 or 5.10.1 or 6.11.1 or 7.8.8 or 8.0.8 or 9.0.8 or 9.1.1 | CVE-2025-11923 | |
| High7.5 | Unauthenticated SQL Injection ≤8.0.6Update to 8.0.7 | CVE-2025-52717 | |
| High7.2 | Authenticated (Admin+) SQL Injection ≤7.7.5Update to 7.7.6 | CVE-2024-7349 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via Shortcode ≤7.6.2Update to 7.6.3 | CVE-2024-4743 | |
| High7.5 | Insecure Direct Object Reference <4.21.2Update to 4.21.2 | CVE-2021-24562 | |
| Critical9.8 | Arbitrary File Write <3.37.15Update to 3.37.15 | CVE-2020-6008 | |
| Critical9.8 | Stored Cross-Site Scripting via Import <3.35.0Update to 3.35.0 | CVE-2019-15896 |
- High7.5Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
≤10.3.1Update to 10.3.2
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
≤10.2.1Update to 10.3.0
- High8.8Various Versions - Authenticated (Student+) Privilege Escalation
≤9.1.0Update to 3.41.2 or 4.21.4 or 5.10.1 or 6.11.1 or 7.8.8 or 8.0.8 or 9.0.8 or 9.1.1
- High7.5Unauthenticated SQL Injection
≤8.0.6Update to 8.0.7
- High7.2Authenticated (Admin+) SQL Injection
≤7.7.5Update to 7.7.6
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤7.6.2Update to 7.6.3
- High7.5Insecure Direct Object Reference
<4.21.2Update to 4.21.2
- Critical9.8Arbitrary File Write
<3.37.15Update to 3.37.15
- Critical9.8Stored Cross-Site Scripting via Import
<3.35.0Update to 3.35.0
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: common questions
Does LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: 2 critical, 7 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerability?
CVE-2026-119098, published Nov 6, 2026: LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer. Severity: Medium (CVSS 6.4).
Is any LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerability listed in CISA KEV?
No. None of the known LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes vulnerabilities is currently listed in the CISA KEV catalog.