MasterStudy LMS CVE-2026-81338

Requires an authenticated account at subscriber level or above on a site running MasterStudy LMS before 3.7.50 - trivially met on LMS sites that allow open student/user self-registration, but still a real gate (PR:L, not unauthenticated). The stored HTML payload only fires when another user subsequently views the attacker-submitted content, so victim interaction is required (UI:R). Impact is limited to phishing and content spoofing via injected markup (e.g. iframes); the description does not claim JavaScript/script execution, so this is not a full stored-XSS-to-account-takeover scenario. Limiting factors: needs a registrable/low-priv account, needs a victim to view the content, and is fixed by upgrading to 3.7.50.

This is a genuine but low-priority issue. The vendor/WPScan CVSS of 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) is internally consistent with the description: exploitation requires an authenticated subscriber-level account (PR:L) and a victim must view the stored content (UI:R), yielding only limited confidentiality and integrity impact (C:L/I:L) and no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so all real-world exploitation signals are absent - this maps to 'no public exploit identified at time of analysis' rather than any active-exploitation status. One notable metadata tension: the CWE is CWE-345 (insufficient verification of data authenticity) and the tag is 'Code Injection', but the description actually describes stored HTML/markup injection (iframe embedding for phishing and content spoofing) with no claim of script or code execution - this is closer to CWE-79/CWE-80 stored HTML injection, so the 'Code Injection' framing overstates the technical severity (no RCE, no persistent script execution asserted). Net: real but modest phishing/spoofing risk requiring both a foothold account and victim interaction, not an urgent-patch emergency.

An attacker registers a free subscriber-level account on a site running MasterStudy LMS (self-registration is common on LMS sites), then submits course/profile/discussion content containing injected HTML such as an <iframe> pointing to an attacker-controlled phishing page. When another user - a student or instructor - views that content, the spoofed/embedded material renders inline, enabling credential-phishing or content spoofing. No public POC or exploit code was referenced, and success depends on the victim actually viewing the poisoned content.