LifterLMS vs Whatfix

LifterLMS landed its v10.0 major release in early May, bringing lesson content editing directly into the Course Builder, a focus mode for learners, an Events tab, and a unified 'Any' trigger for engagements. The two weeks since have been spent on three security hotfixes (v10.0.1, v10.0.2, v10.0.3) tightening permission checks on the new course-builder data paths. The 9.x line that preceded it also leaned heavily on security work, with multiple releases acknowledging external reporters.

The product is consolidating around a modern Gutenberg-era course builder as the central authoring surface and aligning with WordPress core conventions (replacing custom llms_verify_nonce calls with standard WP nonce checks, dropping deprecated SQL_CALC_FOUND_ROWS). The recurring cadence of permission-check patches — both pre- and post-v10 — suggests LifterLMS is attracting sustained external security scrutiny as it grows.

Expect a v10.1.x line that finishes locking down the new course-builder permission surface and continues retiring custom helpers in favor of WP-core equivalents. The Events tab introduced in v10.0 is the next feature surface to watch — it shipped with minimal content and is likely to expand.