LifterLMS instructors can store JavaScript in course pricing markup
LifterLMS versions 9.2.3 through 10.0.9 permit an Instructor or another role able to edit courses to place event-handler attributes in Course Options > Featured Pricing Information. The attacker-controlled markup is stored in the _llms_featured_pricing post meta without removing handlers such as onclick, then rendered unescaped in the course editor and on the public course catalog. The script can therefore execute in an Administrator's wp-admin session when the administrator views and interacts with the affected course, as well as in public visitors' sessions. Version 10.0.10 adds sanitization to the pricing-display markup.
- Component
- LifterLMS
- Plugin slug
lifterlms- Affected
- 9.2.3 to < 10.0.10
- Safe version
10.0.10- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 18 known issues for this plugin.
Update, patch or deactivate.
Update LifterLMS to 10.0.10 or later. Review _llms_featured_pricing values on courses authored by untrusted instructors for event-handler attributes or unexpected HTML, remove malicious markup, and investigate administrator activity after affected courses were opened.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N