The LifterLMS WordPress plugin versions older than 10.0.10 do not strip event‑handler attributes from a course pricing field before storing and rendering it. This omission allows any user with a course‑editing role to inject and persist JavaScript that runs in the browser of an administrator who views the course. The flaw is a classic stored cross‑site scripting vulnerability classified as CWE‑79, providing attackers the ability to execute code in the context of privileged users over the web interface.

The affected product is the LifterLMS WordPress plugin. All deployments using any version prior to 10.0.10 are vulnerable. Administrators should verify that their installation is running 10.0.10 or later, as older releases lack the patch that removes the unsanitized event‑handler attributes.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. The EPSS score is below 1 %, reflecting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker must possess a role that permits editing of course data, after which malicious JavaScript is stored and subsequently executed when an authenticated administrator views the affected course. No public exploits are currently known, but the persistence of code in administrator sessions elevates the potential damage if leveraged.