Riskcovery

CVE-2021-24308

LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile

State
Published
Severity
Not scored
Published
May 24, 2021
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-79 Cross-site Scripting (XSS)

Affected Products

ProductVersions
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPressLifterLMS
  • 4.21.1 to before 4.21.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.