CVE-2026-14207 is a CWE-79 Cross-Site Scripting vulnerability in the LifterLMS WordPress plugin. Versions prior to 10.0.10 do not sanitize event-handler attributes in a course pricing field before storing and rendering it. This allows users with course-editing roles to inject JavaScript code that executes in the administrator's session upon viewing the course, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

An attacker with course-editing permissions can inject malicious JavaScript that executes in the context of an administrator's session. This can lead to unauthorized actions performed by the administrator, such as session hijacking or privilege escalation within the WordPress environment. The vulnerability does not impact availability and has a medium overall severity.

No official patch or remediation level is currently confirmed. Users should upgrade to LifterLMS version 10.0.10 or later once available, as the vulnerability affects versions before 10.0.10. Until a fix is confirmed, restrict course-editing permissions to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.