WordPress Plugin Vulnerabilities

LifterLMS < 4.21.1 - Reflected Cross-Site Scripting (XSS) via Coupon Code in Checkout

Description

The plugin did not properly sanitise the coupon code during checkout before outputting in back the error message in the page, leading to a reflected Cross-Site Scripting issue

Affects Plugins

Plugin icon
lifterlms
Fixed in 4.21.1

References

URL
https://github.com/gocodebox/lifterlms/releases/tag/4.21.1
URL
https://github.com/gocodebox/lifterlms/commit/da76812ea943dd1d6e6812b57cf3fd447aaf7530

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Ashish Jha
Verified
Yes
WPVDB ID
5ce667ae-9e38-4d25-919e-3b956874f869

Timeline

Publicly Published
2021-05-10 (about 4 years ago)
Added
2021-05-10 (about 4 years ago)
Last Updated
2021-05-12 (about 4 years ago)

Other

Published
Title
Published
2014-09-27
Title
SI CAPTCHA 2.7.4 - Cross-Site Scripting (XSS)
Published
2024-04-25
Title
Recencio Book Reviews <= 1.66.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-03-24
Title
DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2022-07-19
Title
Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site Scripting
Published
2024-04-05
Title
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor < 3.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block