What is the CVSS score of CVE-2026-59513?

CVE-2026-59513 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Masteriyo LMS CVE-2026-59513

EUVD-2026-48186 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-g763-qq67-4q57

XSS Masteriyo Lms

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects required subscriber account; UI:R for victim page view; S:C for cross-user script execution; A:N as XSS does not cause direct availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:07 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

AnalysisAI

Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Masteriyo LMS is a WordPress learning management system plugin (CPE: cpe:2.3:a:masteriyo:masteriyo_-_lms:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input from subscriber-level accounts is not properly sanitized or encoded before being rendered in HTML output. WordPress subscribers are the lowest default authenticated role, able only to read content and manage their own profile. The flaw likely exists in a subscriber-accessible input field - such as a course review, profile field, or quiz response - where the plugin fails to apply wp_kses or equivalent output escaping before rendering stored data to other users, including administrators.

RemediationAI

Update the Masteriyo LMS plugin to a version above 2.3.0 via the WordPress admin dashboard or the official WordPress plugin repository. The Patchstack advisory at the reference URL should be consulted to confirm the exact patched version number, as no specific fix version was included in the available intelligence data. As a compensating control pending patching, site administrators should disable open subscriber self-registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted users from obtaining the subscriber role required to exploit this flaw - note this may impact course enrollment workflows that depend on self-registration. Additionally, a Web Application Firewall rule blocking common XSS payloads in POST parameters can reduce exposure but should not be treated as a permanent substitute for patching.