CVE-2026-14207 is a stored Cross-Site Scripting (CWE-79) vulnerability in the LifterLMS WordPress plugin. Specifically, versions before 10.0.10, including 9.2.3, fail to sanitize event-handler attributes in a course pricing field, enabling users with course-editing roles to inject malicious JavaScript. This script executes when an administrator views the affected course, potentially compromising the administrator's session or performing unauthorized actions within their context. No CVSS score or official remediation level has been provided, and no known exploits are reported in the wild.

The vulnerability allows users with course-editing privileges to inject JavaScript that executes in the administrator's session when viewing the course. This could lead to session hijacking, unauthorized actions, or other malicious activities performed with administrator privileges. The impact is limited to environments where untrusted users have course-editing roles and administrators view the affected course content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict course-editing permissions to trusted users only and avoid administrators viewing untrusted course content. Monitor vendor communications for updates regarding a patch or official mitigation.