Lifterlms ≫ Lifterlms

14 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.

9.8

CVE-2025-52717

EPSS 0.04%
Veröffentlicht 27.06.2025 11:52:28
Zuletzt bearbeitet 11.07.2025 14:21:09

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS allows SQL Injection. This issue affects LifterLMS: from n/a through 8.0.6.

6.1

CVE-2024-13619

Exploit

EPSS 0.14%
Veröffentlicht 15.05.2025 20:15:39
Zuletzt bearbeitet 10.06.2025 13:08:49

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

5.3

CVE-2025-2290

EPSS 0.34%
Veröffentlicht 19.03.2025 04:21:05
Zuletzt bearbeitet 11.07.2025 21:23:28

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to,...

4.3

CVE-2024-12596

EPSS 0.13%
Veröffentlicht 18.12.2024 04:15:08
Zuletzt bearbeitet 11.07.2025 21:23:39

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes i...

7.2

CVE-2024-7349

EPSS 0.96%
Veröffentlicht 06.09.2024 07:15:02
Zuletzt bearbeitet 12.09.2024 12:43:32

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied paramete...

6.5

CVE-2024-4743

EPSS 0.37%
Veröffentlicht 05.06.2024 09:15:10
Zuletzt bearbeitet 21.11.2024 09:43:30

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user...

8.8

CVE-2024-31363

EPSS 0.13%
Veröffentlicht 12.04.2024 13:15:20
Zuletzt bearbeitet 23.01.2025 15:45:13

Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.This issue affects LifterLMS: from n/a through 7.5.0.

5.3

CVE-2024-0377

EPSS 4.16%
Veröffentlicht 13.03.2024 16:15:11
Zuletzt bearbeitet 23.01.2025 19:50:08

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it p...

6.7

CVE-2023-6160

EPSS 1.51%
Veröffentlicht 22.11.2023 16:15:15
Zuletzt bearbeitet 21.11.2024 08:43:16

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with adminis...

6.1

CVE-2022-1250