Stored Cross-Site Scripting Issue in LifterLMS eLearning Plugin for WordPress
CVE-2026-119098
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
What is CVE-2026-119098?
The LifterLMS plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the 'answer[]' parameter. This issue arises from inadequate input sanitization and output escaping in versions up to 10.3.2. An attacker, with subscriber-level access or above, can insert malicious scripts into pages that execute when users visit the affected pages. Exploitation necessitates the attacker to be a student in a course with a quiz question, where the injected payload can run in the admin's browser during the grading process upon clicking 'Start a Review'.
Affected Version(s)
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes 0 <= 10.3.2