LifterLMS records

14 published records for vendor lifterlms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 21.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2019-15896Proof of concept	An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.lifterlms · lifterlms · CWE-306 Pre-auth Auth bypass XSS	Critical9.8	—	6.5%	Sep 10, 2019
40Plan	CVE-2020-6008No exploit	LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionlifterlms · lifterlms · CWE-434 pre-auth RCE File upload	Critical9.8	—	3.8%	Mar 31, 2020
39Monitor	CVE-2025-52717No exploit	WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerabilitylifterlms · lifterlms · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	Jun 27, 2025
35Monitor	CVE-2024-4743No exploit	LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcodelifterlms · lifterlms · CWE-89 SQL injection	High8.8	—	0.5%	Jun 5, 2024
35Monitor	CVE-2024-31363No exploit	WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerabilitylifterlms · lifterlms · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Apr 12, 2024
30Monitor	CVE-2021-24562No exploit	LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDORlifterlms · lifterlms · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	1.6%	Aug 23, 2021
28Monitor	CVE-2024-7349No exploit	LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injectionlifterlms · lifterlms · CWE-89 SQL injection	High7.2	—	0.5%	Sep 6, 2024
26Monitor	CVE-2023-6160No exploit	LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletionlifterlms · lifterlms · CWE-22 Path traversal	Medium6.7	—	0.8%	Nov 22, 2023
24Monitor	CVE-2022-1250No exploit	LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scriptinglifterlms · lifterlms · CWE-79 Pre-auth XSS	Medium6.1	—	1.0%	May 2, 2022
24Monitor	CVE-2024-13619Proof of concept	LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSSlifterlms · lifterlms · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 15, 2025
22Monitor	CVE-2021-24308Proof of concept	LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profilelifterlms · lifterlms · CWE-79 XSS	Medium5.4	—	3.2%	May 24, 2021
21Monitor	CVE-2024-0377No exploit	LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_reviewlifterlms · lifterlms · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.7%	Mar 13, 2024
21Monitor	CVE-2025-2290No exploit	LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashinglifterlms · lifterlms · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.3%	Mar 19, 2025
17Monitor	CVE-2024-12596No exploit	LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionlifterlms · lifterlms · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.3%	Dec 18, 2024

CVE-2019-15896
41Plan
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.
CriticalCVSS 9.8Proof of conceptEPSS 6%
lifterlms · lifterlmsSep 10, 2019
CVE-2020-6008
40Plan
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- File upload
lifterlms · lifterlmsMar 31, 2020
CVE-2025-52717
39Monitor
WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
lifterlms · lifterlmsJun 27, 2025
CVE-2024-4743
35Monitor
LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
lifterlms · lifterlmsJun 5, 2024
CVE-2024-31363
35Monitor
WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
lifterlms · lifterlmsApr 12, 2024
CVE-2021-24562
30Monitor
LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Broken access control (IDOR)
lifterlms · lifterlmsAug 23, 2021
CVE-2024-7349
28Monitor
LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
lifterlms · lifterlmsSep 6, 2024
CVE-2023-6160
26Monitor
LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
MediumCVSS 6.7No exploitEPSS 1%
- Path traversal
lifterlms · lifterlmsNov 22, 2023
CVE-2022-1250
24Monitor
LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
lifterlms · lifterlmsMay 2, 2022
CVE-2024-13619
24Monitor
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
lifterlms · lifterlmsMay 15, 2025
CVE-2021-24308
22Monitor
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
MediumCVSS 5.4Proof of conceptEPSS 3%
- XSS
lifterlms · lifterlmsMay 24, 2021
CVE-2024-0377
21Monitor
LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
lifterlms · lifterlmsMar 13, 2024
CVE-2025-2290
21Monitor
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
lifterlms · lifterlmsMar 19, 2025
CVE-2024-12596
17Monitor
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
lifterlms · lifterlmsDec 18, 2024