WordPress Plugin Vulnerabilities

Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

Description

The plugin does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.

Proof of Concept

Affects Plugins

Plugin icon
learning-management-system
Fixed in 3.4.0

References

CVE
CVE-2026-82846

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Mutantgun
Submitter
Mutantgun
Submitter website
https://mutantgun.com/
Verified
Yes
WPVDB ID
0ee2052c-90a8-4b98-947a-adc55feb1de7

Timeline

Publicly Published
2026-09-03 (about 22 hours ago)
Added
2026-09-03 (about 8 hours ago)
Last Updated
2026-09-03 (about 8 hours ago)

Other

Published
Title
Published
2022-11-17
Title
News Announcement Scroll < 9.0.0 - Admin+ Stored XSS
Published
2024-04-05
Title
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor < 3.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block
Published
2025-04-01
Title
WebinarPress <= 1.33.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-10-27
Title
PubyDoc <= 2.0.6 - Admin+ Stored XSS
Published
2025-01-17
Title
Image Source Control Lite – Show Image Credits and Captions < 2.28.1 - Reflected Cross-Site Scripting