EUVD-2026-71857
GHSA-q7cm-xchw-5v25
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
S:C because the XSS payload executes outside the attacker's course-author privilege scope in an admin session; A:N because availability impact on the subsequent system is not a direct consequence of session theft.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
AnalysisAI
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid course-author role account on the target WordPress site; anonymous users, subscribers, and other low-privilege roles cannot exploit this vulnerability without first obtaining course-author privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) modestly understates real-world risk: the S:U designation conflicts with the clearly cross-user impact described, since the XSS payload executes in an administrator's browser and can perform actions entirely outside the course-author's own privilege scope - a condition that technically warrants S:C under CVSS 3.1 guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Masteriyo LMS plugin to version 3.4.0 or later, which introduces proper sanitization and output escaping of course settings - this is the definitive remediation per the WPScan disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Masteriyo Lms
View allUnauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learni
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role use
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticat
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authen
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today