Medium severity · published Sep 23, 2026
CVE-2026-81338
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
4.6
CVSS
0.1%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin ·
before 3.7.50 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81338
wpscan.com
https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/
More from MasterStudy LMS WordPress Plugin
7.2
CVE-2026-88843
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
5.3
CVE-2026-88846
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-81199
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
5.3
CVE-2026-81197
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
5.3
CVE-2026-81195
MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route