EUVD-2026-59915
GHSA-9qrh-j6xc-w4qf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Instructor-role account required elevates PR to L; stored XSS crosses scope boundary into victim browser; no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.
AnalysisAI
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid instructor-role account on the target WordPress site, as the instructor role is specifically what receives the unfiltered HTML storage capability in single-site configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-provided CVSS base score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a Scope:Changed impact but incorrectly records PR:N - the description explicitly requires an instructor-role account, indicating the vector should carry PR:L, which would lower the score to approximately 5.4. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Masteriyo LMS WordPress plugin to version 2.3.3 or later, which is confirmed as the vendor-released patched version per the WPScan advisory at https://wpscan.com/vulnerability/08c31101-ee38-46e9-b451-abb1ed70079c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Masteriyo Lms
View allUnauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learni
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authen
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today