Masteriyo course fields let instructors target administrators with XSS
Masteriyo LMS before 3.4.1 fails to sanitize and escape a course field before displaying it in the course editor. An instructor can store JavaScript in that field; it executes for a higher-privileged user such as an administrator who opens the course editor. The authoritative export does not identify the field, save endpoint, or output context.
- Component
- Masteriyo LMS
- Plugin slug
masteriyo-lms- Affected
- < 3.4.1
- Safe version
3.4.1- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update Masteriyo LMS to 3.4.1 or later. The authoritative affected range ends before 3.4.1. The application-level fix must sanitize the course field on write and escape it for its exact course-editor output context.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H