CVE-2021-24308 LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
Low-privilege users can inject malicious scripts via the profile state field, potentially escalating privileges when admins view the profile.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24308?
CVE-2021-24308 is a medium-severity cross-site scripting vulnerability in LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress, published on 24 May 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Weakness: CWE-79
Which versions are affected by CVE-2021-24308?
It affects 1 product.
Products include Lifterlms Lifterlms.
How do I fix CVE-2021-24308?
No fix has been published for CVE-2021-24308 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-24308 being exploited?
There is no known exploitation of CVE-2021-24308 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress
- CVE-2020-6008 File upload in LifterLMS Wordpress Plugin
- CVE-2019-15896 Missing authorization in n/a
- CVE-2025-52717 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability
- CVE-2024-4743 LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode
- CVE-2021-24562 LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
Sources
Also known as GHSA-3mxr-2h37-xpjx.