Medium severity · published Sep 12, 2026
CVE-2026-82847
Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Masteriyo LMS ·
before 3.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82847
wpscan.com
https://wpscan.com/vulnerability/9cc4f7a7-e5b9-48fe-962b-f5d0753e6158/
More from Masteriyo LMS
9.9
CVE-2026-82845
Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
9.1
CVE-2026-13332
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
6.8
CVE-2026-82846
Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
6.5
CVE-2026-10824
Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion
6.1
CVE-2026-19712
Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description