Lifterlms vulnerabilities

Products

• Lifterlms 14
• – Wp Lms For Elearning, Online Courses, & Quizzes 3

Newest

• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer CVE-2026-119098 6.4 MediumNovember 7, 2026
• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes CVE-2026-110284 7.5 HighOctober 14, 2026
• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data CVE-2026-104723 8.8 HighOctober 10, 2026
• chrisbadgett lifterlms WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability CVE-2025-52717 9.3 CriticalJune 27, 2025
• lifterlms LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS CVE-2024-13619 6.1 MediumMay 15, 2025
• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 more LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing CVE-2025-2290 5.3 MediumMarch 19, 2025
• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 more LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion CVE-2024-12596 4.3 MediumDecember 18, 2024
• chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 more LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection CVE-2024-7349 7.2 HighSeptember 6, 2024
• lifterlms, chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode CVE-2024-4743 8.8 HighJune 5, 2024
• lifterlms WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31363 4.3 MediumApril 12, 2024
• lifterlms, chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review CVE-2024-0377 5.3 MediumMarch 13, 2024
• lifterlms, chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion CVE-2023-6160 3.3 LowNovember 22, 2023
• lifterlms, unknown lifterlms paypal +1 more LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting CVE-2022-1250 6.1 MediumMay 2, 2022
• lifterlms, unknown lms by lifterlms – online course, membership & learning management system plugin for wordpress +1 more LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR CVE-2021-24562 7.5 HighAugust 23, 2021
• lifterlms, lifterlms lms by lifterlms – online course, membership & learning management system plugin for wordpress +1 more LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile CVE-2021-24308 Public exploit 5.4 MediumMay 24, 2021
• lifterlms LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to... CVE-2020-6008 9.8 CriticalMarch 31, 2020
• lifterlms An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import... CVE-2019-15896 Public exploit 9.8 CriticalSeptember 10, 2019