CyberRota Analysis
AI-GeneratedThe LifterLMS WordPress plugin prior to version 10.0.10 is vulnerable due to improper handling of event-handler attributes in a course pricing field, enabling users with course-editing permissions to inject malicious JavaScript. This could lead to session hijacking or other attacks against administrators who view the affected course. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate potential risks.
Original NVD Description
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.