Skip to main content

Masteriyo LMS CVE-2026-19712

| EUVDEUVD-2026-59915 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-16 WPScan GHSA-9qrh-j6xc-w4qf
XSS WordPress Masteriyo Lms
6.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
5.4 MEDIUM

Instructor-role account required elevates PR to L; stored XSS crosses scope boundary into victim browser; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 20:23 vuln.today
CVSS changed
Aug 17, 2026 - 20:22 NVD
6.1 (MEDIUM)
Patch available
Aug 16, 2026 - 07:01 EUVD
CVE Published
Aug 16, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 16, 2026 - 06:00 cve.org
MEDIUM 6.1

DescriptionCVE.org

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.

AnalysisAI

Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker registers or compromises instructor-role account
Delivery
Inject malicious JavaScript into quiz field via plugin interface
Exploit
Payload persisted to database without sanitization
Execution
Victim (including admin) visits affected quiz page
Persist
Stored script executes in victim browser
Impact
Session token exfiltrated or admin-level action performed
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to possess a valid instructor-role account on the target WordPress site, as the instructor role is specifically what receives the unfiltered HTML storage capability in single-site configurations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-provided CVSS base score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a Scope:Changed impact but incorrectly records PR:N - the description explicitly requires an instructor-role account, indicating the vector should carry PR:L, which would lower the score to approximately 5.4. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who holds or registers a legitimate instructor-role account on a vulnerable single-site Masteriyo LMS installation crafts a quiz field containing a JavaScript payload - such as a cookie-stealing script that exfiltrates document.cookie to an attacker-controlled endpoint. The payload is saved to the database and served unescaped to every subsequent visitor of that quiz page. …
Remediation Upgrade the Masteriyo LMS WordPress plugin to version 2.3.3 or later, which is confirmed as the vendor-released patched version per the WPScan advisory at https://wpscan.com/vulnerability/08c31101-ee38-46e9-b451-abb1ed70079c/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Masteriyo Lms

View all
CVE-2026-13332 CRITICAL POC
9.1 Jul 27

Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2
CVE-2026-10824 MEDIUM POC
6.5 Jun 25

Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learni
CVE-2026-73996 CRITICAL
9.8 Aug 18

Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
CVE-2026-49111 HIGH
8.8 Jun 15

Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authen
CVE-2026-39524 HIGH
7.5 Jun 15

Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
CVE-2026-59513 MEDIUM
6.5 Jul 23

Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
CVE-2026-42743 MEDIUM
6.5 Jun 15

Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
CVE-2026-65463 MEDIUM
5.4 Jul 23

Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-19712 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy