MasterStudy LMS EUVD-2026-94952

Exploitation requires an authenticated account on the target site (CVSS PR:L), meaning the attacker must already hold a low-privilege role such as a student or instructor within MasterStudy LMS, and requires victim user interaction (UI:R) - a privileged user must view the page or dashboard view containing the stored payload. The flaw is therefore limited by the need for both valid (even if self-registered) credentials and a victim rendering the injected content; it does not permit unauthenticated remote exploitation. The scope change (S:C) reflects that the injected script executes in the victim's browser context rather than the attacker's. Affected configurations are any site running MasterStudy LMS from the earliest versions up to and including 3.7.52.

This is a moderate-severity, authenticated Stored XSS (CWE-79) in the MasterStudy LMS WordPress plugin, carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation but requires at least low-privilege authentication (PR:L) and victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser/security context. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - per precision rules this is 'no public exploit identified at time of analysis.' The SSVC framework cannot be fully applied as no SSVC decision data was supplied. Net assessment: this is a real but not top-priority issue - the combination of required authentication and required user interaction materially limits mass exploitation, making it a patch-in-normal-cycle item rather than an emergency, though the stored nature means a low-privileged user (e.g., an instructor or student role) could persistently target higher-privileged admins. The low confidentiality/integrity/availability impacts (all C:L/I:L/A:L) are consistent with typical browser-context XSS rather than direct server compromise.

A user with a low-privilege authenticated role on an LMS site (such as an instructor or student) submits content - e.g. a course field, profile, or comment - containing a malicious script payload that is stored by the plugin. When an administrator or another user later views that content in the WordPress dashboard or front end, the script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept is referenced, so exploitation would require an attacker to independently develop the payload.