CVE-2026-19712
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Masteriyo LMS WordPress plugin before version 2.3.3 does not sanitize and escape a quiz field before output, and grants instructors the ability to store unfiltered HTML, allowing Stored XSS attacks against any visitor, including administrators. Default single-site installations are affected; multisite or DISALLOW_UNFILTERED_HTML sites are not.
Risk Assessment
The risk includes admin session hijacking, data theft, and content modification via malicious scripts in victims' browsers.
Recommendation
Update the plugin to version 2.3.3 or later and restrict instructor role capabilities if possible.
Original NVD description (English source)
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.