LifterLMS < 8.0.1 - Cross-Site Scripting

CVE-2024-13619

Verified

Description

LifterLMS WordPress plugin before 8.0.1 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin via a crafted request.

Severity

Medium

CVSS Score

6.1

Exploit Probability

Published Date

February 6, 2026

Template Author

shivam kamboj

CVE-2024-13619.yaml

6.1Score

CVSS Metrics

CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE ID:

cve-2024-13619

CWE ID:

cwe-79

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/lifterlms/lifterlms-800-reflected-cross-site-scripting https://wpscan.com/vulnerability/97a7e1a6-0fb3-49e9-86fc-ebb1d426fcca/https://nvd.nist.gov/vuln/detail/CVE-2024-13619

Remediation Steps

Update to version 8.0.1 or later.

LifterLMS < 8.0.1 - Cross-Site Scripting

Description

Severity

CVSS Score

Exploit Probability

Published Date

Template Author

Nuclei Template

CVSS Metrics

References

Remediation Steps

LifterLMS < 8.0.1 - Cross-Site Scripting

Description

Severity

CVSS Score

Exploit Probability

Published Date

Template Author

Nuclei Template

CVSS Metrics

References

Remediation Steps