{"id":"CVE-2026-119098","kind":"vulnerability","aliases":["CVE-2026-119098"],"related":[],"title":"LifterLMS WordPress plugin: stored XSS via quiz answers reaches admins","description":"The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer[]' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to be enrolled as a student in a course containing a Content-type quiz question; the injected payload executes in the administrator's browser session during the normal grading workflow when 'Start a Review' is clicked on the affected attempt.","summary":"The LifterLMS WordPress plugin does not sanitize the 'answer[]' quiz parameter, so a student can store a script that runs later. When an administrator opens the attempt during grading ('Start a Review'), the script runs in their browser session.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elearning","lifterlms","package","wordpress"],"not_affected_if":["newer-version","no-content-type-quiz-questions","plugin-not-installed"],"how_to_check":"- Check the installed LifterLMS plugin version in the WordPress admin Plugins screen against the affected range (all versions up to and including `10.3.2`).\n- Look for the plugin's `lifterlms` directory under `wp-content/plugins/` and read its version header.","fix":null,"status":"open","published_at":"2026-11-07T03:17:00+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","triaged_at":"2026-11-07T03:47:53+00:00","updated_at":"2026-11-07T03:47:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T03:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LifterLMS WordPress plugin: stored XSS via quiz answers reaches admins","impact":"medium","summary":"The LifterLMS WordPress plugin does not sanitize the 'answer[]' quiz parameter, so a student can store a script that runs later. When an administrator opens the attempt during grading ('Start a Review'), the script runs in their browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","lifterlms","elearning"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin browser session runs attacker script during grading review","analyst_note":"Confirm the fixed version in the Wordfence or NVD entry; the sources given do not name one.","how_to_check":"- Check the installed LifterLMS plugin version in the WordPress admin Plugins screen against the affected range (all versions up to and including `10.3.2`).\n- Look for the plugin's `lifterlms` directory under `wp-content/plugins/` and read its version header.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","no-content-type-quiz-questions"],"who_is_affected":"Sites running the LifterLMS plugin for WordPress at version `10.3.2` or earlier, where students take quizzes with Content-type questions. The risk lands on administrators and graders who open student attempts with 'Start a Review'. Sites without LifterLMS, or on a newer version, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4382,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119098':13A,16A '-2026':12A,15A '10.3.2':91C 'access':111C,127C 'admin':10A 'administr':44B,157C 'affect':174C 'answer':8A,29B,82C 'arbitrari':116C 'attack':106C,134C 'attempt':47B,175C 'authent':105C 'browser':58B,159C 'click':171C 'contain':144C 'content':147C 'content-typ':146C 'cours':67C,143C 'cross':77C 'cross-sit':76C 'cve':11A,14A 'due':92C 'elearn':17B,65C 'enrol':137C 'escap':99C 'execut':123C,154C 'exploit':131C 'grade':49B,164C 'includ':90C 'inject':115C,129C,152C 'input':95C 'insuffici':94C 'later':41B 'level':110C 'lifterlm':1A,18B,22B,61C 'lms':63C 'make':101C 'normal':163C 'onlin':66C 'open':45B 'output':98C 'packag':19B 'page':120C,130C 'paramet':31B,83C 'payload':153C 'plugin':3A,24B,69C 'possibl':103C 'question':150C 'quiz':7A,30B,149C 'quizz':68C 'reach':9A 'requir':132C 'review':52B,169C 'run':40B,55B 'sanit':27B,96C 'script':38B,54B,79C,118C 'session':59B,160C 'site':78C 'start':50B,167C 'store':4A,36B,75C 'student':34B,140C 'subscrib':109C 'subscriber-level':108C 'type':148C 'user':126C 'version':86C 'via':6A,80C 'vulner':73C 'web':117C 'whenev':124C 'wordpress':2A,20B,23B,71C 'workflow':165C 'wp':62C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the LifterLMS plugin for WordPress at version `10.3.2` or earlier, where students take quizzes with Content-type questions. The risk lands on administrators and graders who open student attempts with 'Start a Review'. Sites without LifterLMS, or on a newer version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elearning","lifterlms","medium","package","wordpress"],"campaign_type":null,"search_a":"'-119098':13A,16A '-2026':12A,15A 'admin':10A 'answer':8A 'cve':11A,14A 'lifterlm':1A 'plugin':3A 'quiz':7A 'reach':9A 'store':4A 'via':6A 'wordpress':2A 'xss':5A","search_b":"'administr':44B 'answer':29B 'attempt':47B 'browser':58B 'elearn':17B 'grade':49B 'later':41B 'lifterlm':18B,22B 'open':45B 'packag':19B 'paramet':31B 'plugin':24B 'quiz':30B 'review':52B 'run':40B,55B 'sanit':27B 'script':38B,54B 'session':59B 'start':50B 'store':36B 'student':34B 'wordpress':20B,23B","search_c":"'10.3.2':91C 'access':111C,127C 'administr':157C 'affect':174C 'answer':82C 'arbitrari':116C 'attack':106C,134C 'attempt':175C 'authent':105C 'browser':159C 'click':171C 'contain':144C 'content':147C 'content-typ':146C 'cours':67C,143C 'cross':77C 'cross-sit':76C 'due':92C 'elearn':65C 'enrol':137C 'escap':99C 'execut':123C,154C 'exploit':131C 'grade':164C 'includ':90C 'inject':115C,129C,152C 'input':95C 'insuffici':94C 'level':110C 'lifterlm':61C 'lms':63C 'make':101C 'normal':163C 'onlin':66C 'output':98C 'page':120C,130C 'paramet':83C 'payload':153C 'plugin':69C 'possibl':103C 'question':150C 'quiz':149C 'quizz':68C 'requir':132C 'review':169C 'sanit':96C 'script':79C,118C 'session':160C 'site':78C 'start':167C 'store':75C 'student':140C 'subscrib':109C 'subscriber-level':108C 'type':148C 'user':126C 'version':86C 'via':80C 'vulner':73C 'web':117C 'whenev':124C 'wordpress':71C 'workflow':165C 'wp':62C","first_public_at":"2026-11-07T03:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119098","severity":null,"published_at":"2026-11-07T03:17:00+00:00","modified_at":"2026-11-07T03:17:01+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","fetched_at":"2026-11-07T03:45:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}