EUVD-2026-71857
GHSA-q7cm-xchw-5v25
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
S:C because the XSS payload executes outside the attacker's course-author privilege scope in an admin session; A:N because availability impact on the subsequent system is not a direct consequence of session theft.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
AnalysisAI
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid course-author role account on the target WordPress site; anonymous users, subscribers, and other low-privilege roles cannot exploit this vulnerability without first obtaining course-author privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) modestly understates real-world risk: the S:U designation conflicts with the clearly cross-user impact described, since the XSS payload executes in an administrator's browser and can perform actions entirely outside the course-author's own privilege scope - a condition that technically warrants S:C under CVSS 3.1 guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Masteriyo LMS plugin to version 3.4.0 or later, which introduces proper sanitization and output escaping of course settings - this is the definitive remediation per the WPScan disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Masteriyo Lms
View allUnauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learni
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role use
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticat
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authen
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthoriz
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today