Masteriyo LMS < 3.4.1 – Instructor+ Stored XSS via Course Highlights | CVE 2026-82847

Description

The plugin does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.

Proof of Concept

The PoC will be displayed on September 24, 2026, to give users the time to update.

Affects Plugins

learning-management-system

Fixed in 3.4.1

References

CVE

CVE-2026-82847

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Karthik Ramakrishnan

Submitter

Karthik Ramakrishnan

Verified

Yes

WPVDB ID

9cc4f7a7-e5b9-48fe-962b-f5d0753e6158

Timeline

Publicly Published

2026-09-10 (about 2 days ago)

Added

2026-09-10 (about 1 day ago)

Last Updated

2026-09-10 (about 1 day ago)

Other

Published

Title

Published

2018-07-28

Title

Woocommerce Jetpack < 3.8.0 - XSS

Published

2024-02-20

Title

File Manager Pro < 8.3.5 - Reflected Cross-Site Scripting

Published

2024-07-22

Title

Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2019-06-26

Title

WP Ultimate Recipe <= 3.12.6 - Authenticated Stored XSS

Published

2023-12-27

Title

Restaurant Reservations < 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting