CVE-2026-14207— LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
Possible ATT&CK Techniques 2AI
T1133 · External Remote Services T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14207
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
Source: CVE Program / CVE List V5
Vulnerability Description
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress LifterLMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
lifterlms是lifterlms公司开源的一个创建在线课程的学习管理系统。 WordPress LifterLMS 10.0.10之前版本存在跨站脚本漏洞，该漏洞源于未清除课程定价字段中的事件处理属性，导致具有课程编辑角色的用户注入JavaScript，在查看课程的管理员会话中执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-14207
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14207
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14207 (1)
- 🔗 LifterLMS < 10.0.10 – Instructor+ Stored XSS via Featured Pricing Information | CVE 2026-14207 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-30 · 36 CVEs total
| CVE-2026-13145 | WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR | |
| CVE-2026-15240 | Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrat | |
| CVE-2026-15382 | Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Dele | |
| CVE-2026-11870 | Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Prote | |
| CVE-2026-11867 | Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/De | |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | |
| CVE-2026-11782 | Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Poin | |
| CVE-2026-12500 | WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update | |
| CVE-2026-13143 | WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN | |
| CVE-2026-15257 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modificatio | |
| CVE-2026-13344 | Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table | |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-13345 | Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce | |
| CVE-2026-13178 | Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation | |
| CVE-2026-13395 | Bookly < 27.8 - Unauthenticated SQL Injection via staff_id | |
| CVE-2026-14310 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection | |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | |
| CVE-2026-14305 | WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes | |
| CVE-2026-15235 | Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX | |
| CVE-2026-14188 | Easy Appointments <= 3.12.26 - Contributor+ Customer Data Disclosure |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: LifterLMS
Same vendor: Unknown
- CVE-2026-16296
Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler - CVE-2026-16546
Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbi - CVE-2026-16295
Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosu - CVE-2026-16547
REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Di - CVE-2026-16548
Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload v
V. Comments for CVE-2026-14207
No comments yet