LifterLMS < 10.0.10 – Instructor+ Stored XSS via Featured Pricing Information | CVE 2026-14207

Description

The plugin does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

Proof of Concept

Prerequisites: a user holding an LMS role that can edit courses (Instructor). Instructors can create/publish their own courses, so no admin pre-step is needed.

1. As the Instructor, edit your course: /wp-admin/post.php?post={COURSE_ID}&action=edit
2. In Course Options > Featured Pricing Information, enter:
       <span onclick="alert(document.cookie)">Buy Now - $49.99</span>
3. Update the course. The onclick attribute survives sanitization and is stored in the _llms_featured_pricing meta.
4. When an administrator opens that course in the editor, the payload renders live and unescaped in their wp-admin session; clicking the inline pricing field executes the script in the admin context. (The same value also renders on the public course-catalog page.)