LifterLMS is a learning-management-system plugin with a concentrated vulnerability profile centered on web-application input and authorization handling. Its disclosed vulnerabilities skew toward serious outcomes and frequently acquire public exploit tooling, with recurring weaknesses including cross-site scripting, SQL injection, missing and bypassable authorization, and cross-site request forgery that are typical of access-control and data-validation gaps in plugin-based educational platforms. Defenders should treat patches for this plugin as a priority for WordPress-backed learning environments; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lifterlms over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-15896CRITICAL An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated op | Sep 10, 2019 | 9.8 | 32 | NO | NO |
CVE-2025-52717CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects Lifte | Jun 27, 2025 | 9.8 | 29 | NO | NO |
CVE-2021-24308MEDIUM The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properl | May 24, 2021 | 5.4 | 29 | NO | YES |
CVE-2020-6008CRITICAL LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution | Mar 31, 2020 | 9.8 | 28 | NO | NO |
CVE-2024-13619MEDIUM The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could | May 15, 2025 | 6.1 | 27 | NO | YES |
CVE-2024-4743HIGH The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all version | Jun 5, 2024 | 8.8 | 25 | NO | NO |
CVE-2024-31363HIGH Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.This issue affects LifterLMS: from n/a through 7.5.0. | Apr 12, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-7349HIGH The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and inclu | Sep 6, 2024 | 7.2 | 22 | NO | NO |
CVE-2022-1250MEDIUM The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading | May 2, 2022 | 6.1 | 22 | NO | NO |
CVE-2021-24562HIGH The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see othe | Aug 23, 2021 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lifterlms.
Media articles that mention a CVE ID that affects a product developed by Lifterlms — matched by CVE ID, not by vendor name.