CVE-2026-14207

CVE-2026-14207 is a stored XSS in LifterLMS that allows instructor-level users to escalate to full admin session compromise through the course pricing field. This is not a typical content-injection bug—it exploits a sanitization gap on what should be a simple numeric input. The plugin permitted HTML rendering in pricing fields (likely for currency formatting) but failed to strip dangerous event-handler attributes like onerror, onclick, or onload. Standard XSS filters that block known malicious tags would miss payloads like <img src=x onerror=alert(1)> if img tags were permitted, or attribute injection through allowed div or span elements. The privilege escalation chain is direct: an instructor creates or edits a course, injects a payload into the pricing field, and waits for an administrator to view that course in the dashboard. Because admin sessions automatically include authentication tokens, the payload executes with full admin privileges—session hijacking, plugin installation, or admin account creation follows. You do not need credential theft or social engineering beyond getting an admin to view course data, which is routine in any functioning LMS. Check these immediately: (1) confirm your LifterLMS version—if you are on 10.0.9 or earlier, you are vulnerable; (2) audit whether your pricing fields permit HTML input and whether that input is escaped on admin dashboard render; (3) verify that instructor-role users can access admin dashboard areas that display course data (the vulnerability only works if pricing fields render in admin contexts). The 10.0.10 patch addresses this, but also examine other instructor-accessible fields—course descriptions, instructor bios, and embedded media URLs—for the same sanitization pattern. The deeper issue is that instructor roles in an LMS legitimately access student records, enrollment data, quiz responses, and payment history alongside course content. Compromising an instructor account exposes FERPA-protected educational data, not just course metadata. The EPSS score of 0.00192 is misleadingly low—this is not evidence the vulnerability was never exploited. Automated exploit scanning targets high-market-share plugins and known vulnerability patterns. A stored XSS enabling admin takeover in a niche LMS plugin generates minimal honeypot telemetry, which EPSS models interpret as low risk. Treat this as a high-severity finding regardless of the EPSS score.

Reviewed through automated stages and approved by a human before publication.