{"uuid": "8e559f4f-b395-4e40-8b9d-61c7452d44bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24308", "type": "seen", "source": "https://t.me/hacking_Attack/10506", "content": "Exploit Collector\nWordPress LifterLMS 4.21.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nWordPress LifterLMS plugin version 4.21.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | c047b79bb03f1a1f0db714247c79a29b\n\nDownload\n# Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS) \n# Date: 2021-05-10\n# Exploit Author: Captain_hook\n# Vendor Homepage: https://lifterlms.com/\n# Software Link: https://github.com/gocodebox/lifterlms/releases/tag/4.21.0\n# Version: LifterLMS < 4.21.1\n# Tested on: ANY\n# CVE : CVE-2021-24308\n\n#Summary:\n\nThe 'State' field of the Edit profile page of the LMS by LifterLMS \u00e2\u20ac\u201c Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.\n\n#Proof_of_Concept:\n\n1- As a Lowest Privilege user go to the edit account page of the LMS\n(e.g https://example.com/my-courses/edit-account/)\n\n2- Put Your XSS payload in State parameter and save your edits, such\nas \">\n\n3- The XSS will be stored and triggered in the about section of the profile: (e.g  https://example.com/directory/[user_name]/) (Note): The XSS will also be triggered in the admin dashboard when viewing the user details, for example https://example.com/wp-admin/admin.php?page=llms-reporting&tab=students&stab=information&student_id=2\n\nRefernces:\n\nhttps://github.com/gocodebox/lifterlms/releases/tag/4.21.0\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.411409Z"}