https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-52717.htmlhttps://patchthecve.com/cve/CVE-2025-52717.htmlWed, 17 Jun 2026 09:36:56 +0000CRITICAL 9.3: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.https://patchthecve.com/cve/CVE-2024-13619.htmlhttps://patchthecve.com/cve/CVE-2024-13619.htmlWed, 17 Jun 2026 07:02:23 +0000MEDIUM 6.1: The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.https://patchthecve.com/cve/CVE-2025-2290.htmlhttps://patchthecve.com/cve/CVE-2025-2290.htmlWed, 17 Jun 2026 09:06:41 +0000MEDIUM 5.3: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for https://patchthecve.com/cve/CVE-2024-12596.htmlhttps://patchthecve.com/cve/CVE-2024-12596.htmlWed, 17 Jun 2026 07:00:01 +0000MEDIUM 4.3: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subschttps://patchthecve.com/cve/CVE-2024-7349.htmlhttps://patchthecve.com/cve/CVE-2024-7349.htmlWed, 17 Jun 2026 08:19:55 +0000HIGH 7.2: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existihttps://patchthecve.com/cve/CVE-2024-4743.htmlhttps://patchthecve.com/cve/CVE-2024-4743.htmlWed, 17 Jun 2026 08:02:32 +0000HIGH 8.8: The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparahttps://patchthecve.com/cve/CVE-2024-31363.htmlhttps://patchthecve.com/cve/CVE-2024-31363.htmlWed, 17 Jun 2026 07:28:17 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.This issue affects LifterLMS: from n/a through 7.5.0.