CVE-2026-14207: LifterLMS WordPress Plugin XSS Vulnerability

CVE-2026-14207 Overview

CVE-2026-14207 is a stored Cross-Site Scripting (XSS) vulnerability in the LifterLMS WordPress plugin versions prior to 10.0.10. The plugin fails to strip event-handler attributes from a course pricing field before storing and rendering the input. Users with a course-editing role can inject JavaScript that executes in the browser session of any administrator who subsequently views the affected course. This creates a privilege escalation path from a lower-privileged editor to a WordPress administrator through client-side script execution.

Critical Impact
Authenticated attackers with course-editing permissions can inject persistent JavaScript that executes with administrator context, enabling account takeover, unauthorized configuration changes, and further compromise of the WordPress installation.

Affected Products

LifterLMS WordPress plugin versions prior to 10.0.10
WordPress sites running LifterLMS with users assigned course-editing roles
Administrator accounts on sites hosting vulnerable LifterLMS installations

Discovery Timeline

2026-07-30 - CVE-2026-14207 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14207

Vulnerability Analysis

The vulnerability is a stored XSS flaw [CWE-79] in the LifterLMS learning management plugin for WordPress. LifterLMS accepts input into a course pricing field but does not sanitize event-handler attributes such as onmouseover, onclick, or onerror before storing the value in the WordPress database.

When the stored value is later rendered in the course view or administrative interface, the event-handler attributes survive output encoding. This allows arbitrary JavaScript to execute in the browser of the viewing user. Because administrators routinely review course content submitted by editors, the injected payload reliably fires in a privileged session.

Successful exploitation lets the attacker perform any action the administrator can perform, including creating new administrator accounts, modifying plugin configuration, or installing malicious plugins.

Root Cause

The root cause is incomplete input sanitization on the course pricing field. The plugin strips some HTML constructs but leaves event-handler attributes intact on otherwise permitted tags. This is a common failure pattern where developers rely on tag-based filtering without also stripping on* attributes that trigger script execution.

Attack Vector

Exploitation requires an authenticated user with a course-editing role on the target site. The attacker submits a course with a crafted pricing field containing an HTML element with an event-handler attribute carrying a JavaScript payload. The payload is stored in the WordPress database and executes when an administrator opens the course for review.

The vulnerability does not require user interaction beyond normal administrative review workflow. See the WPScan Vulnerability Report for technical details on the vulnerable field and payload structure.

Detection Methods for CVE-2026-14207

Indicators of Compromise

Unexpected on* event-handler attributes (for example onmouseover=, onerror=, onclick=) stored in LifterLMS course pricing metadata in the wp_postmeta table
Administrator sessions initiating unusual REST API calls to create users, install plugins, or modify options shortly after viewing a course
New administrator accounts created without a corresponding manual admin action in audit logs
Outbound requests from administrator browsers to unfamiliar domains while editing course content

Detection Strategies

Query the WordPress database for LifterLMS course meta values containing patterns such as on\w+\s*= or <script to identify stored payloads
Review web server access logs for POST requests to LifterLMS course endpoints from non-administrator accounts submitting HTML-laden pricing values
Correlate WordPress user-creation and plugin-installation events with the timing of administrator course-review activity

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and alert on administrative privilege changes
Monitor for LifterLMS plugin version drift across managed WordPress sites and flag installations below 10.0.10
Enable Content Security Policy (CSP) reporting to surface inline script execution attempts on WordPress admin pages

How to Mitigate CVE-2026-14207

Immediate Actions Required

Update the LifterLMS plugin to version 10.0.10 or later on all WordPress installations
Audit existing courses for stored payloads containing event-handler attributes and remove or sanitize affected records
Review WordPress user accounts and remove any unauthorized administrator accounts created since the plugin was installed
Rotate credentials and session tokens for administrators who may have viewed attacker-controlled course content

Patch Information

The vendor addressed the issue in LifterLMS version 10.0.10 by stripping event-handler attributes from the course pricing field before storage and rendering. Refer to the WPScan Vulnerability Report for advisory details and version confirmation.

Workarounds

Restrict course-editing roles to trusted users only until the patched version is deployed
Deploy a Web Application Firewall (WAF) rule that blocks HTML event-handler attributes submitted to LifterLMS course endpoints
Implement a strict Content Security Policy on WordPress admin pages to block inline script execution
Require multi-factor authentication for all administrator accounts to limit the impact of session hijacking

bash

# Update LifterLMS via WP-CLI to the patched version
wp plugin update lifterlms --version=10.0.10

# Verify the installed version across sites
wp plugin get lifterlms --field=version