| 2026-10-10 |
WPSEC-2026-0715 |
LifterLMS <= 10.3.0 - Unauthenticated Deleted Access Plan Purchase via Checkout |
Medium 5.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0714 |
LifterLMS <= 10.3.0 - Authenticated (Contributor+) Sensitive Information Exposure via select2_query_posts |
Medium 4.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0713 |
LifterLMS <= 10.3.0 - Unauthenticated Insecure Direct Object Reference to Pending Order Takeover via Checkout |
Medium 6.5 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0712 |
LifterLMS <= 10.3.0 - Authenticated (Subscriber+) CSV Injection via Reporting Exports |
Medium 4.6 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0711 |
LifterLMS <= 10.3.0 - Unauthenticated Sensitive Information Exposure via Certificate oEmbed and Canonical Redirects |
Medium 5.3 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0710 |
LifterLMS <= 10.3.0 - Authentication Bypass via REST API Key Route Restriction |
Medium 5.4 |
10.3.1 |
| 2026-10-10 |
WPSEC-2026-0706 |
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via lifterlms_checkout Shortcode |
High 8.8 |
10.3.2 |
| 2026-10-06 |
WPSEC-2026-0478 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Course Builder Custom Fields |
High 7.5 |
10.3.0 |
| 2026-10-06 |
WPSEC-2026-0477 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Unauthenticated Sensitive Information Exposure via RSS Feeds |
Medium 5.3 |
10.3.0 |
| 2026-10-06 |
WPSEC-2026-0476 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Lesson Clone and Course Import |
High 7.5 |
10.3.0 |
