What is the CVSS score of CVE-2026-57330?

CVE-2026-57330 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

MasterStudy LMS CVE-2026-57330

EUVD-2026-40101 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-j7cj-983v-9p46

WordPress XSS Masterstudy Lms Wordpress Plugin Stylemix

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

XSS with subscriber auth (PR:L), admin interaction required (UI:R), scope change to admin browser (S:C); availability impact not substantiated for typical XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:22 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.

AnalysisAI

Stored Cross-Site Scripting in the MasterStudy LMS WordPress plugin (versions <= 3.7.27) allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The vulnerability carries a Scope:Changed CVSS vector, meaning successful exploitation breaks the browser security boundary and can impact resources beyond the plugin itself - enabling session hijacking, credential theft, or privilege escalation within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber role) widens the attacker pool considerably on sites with open or paid user registration.

Technical ContextAI

MasterStudy LMS (CPE: cpe:2.3:a:stylemix:masterstudy_lms:*:*:*:*:*:*:*:*) is a WordPress plugin by StyleMix that delivers learning management system functionality - courses, quizzes, student enrollment - as a WordPress site component. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input accepted at subscriber privilege level is stored or reflected without sufficient sanitization or output encoding, and then rendered as executable HTML/JavaScript in another user's browser session. The Scope:Changed (S:C) attribute in the CVSS vector confirms the injected script escapes the plugin's own execution context and operates within the broader WordPress admin interface, potentially accessing wp-nonce tokens, cookies, or admin REST API endpoints. The plugin is distributed through the WordPress.org ecosystem and reported by Patchstack, a WordPress-focused vulnerability intelligence provider.

RemediationAI

The primary fix is to update MasterStudy LMS to a version above 3.7.27. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-27-cross-site-scripting-xss-vulnerability) should be consulted for the confirmed patched version number, as no exact fix version was provided in the available data - the precise remediated release is not independently confirmed from the input. If immediate upgrade is not feasible, restrict subscriber-level user registration to trusted parties only, limiting the attacker pool. A WordPress Web Application Firewall (WAF) rule targeting XSS payloads in MasterStudy LMS input fields can provide compensating control but should not replace patching, as WAF rules can be bypassed and introduce maintenance overhead. Administrators should also review Content Security Policy (CSP) headers on the WordPress installation to reduce XSS impact scope, though CSP configuration in WordPress can conflict with legitimate plugin scripts.