CVE-2026-105079: WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMSto a version that resolves this vulnerability.Fixed in 3.7.53
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account or other access level that provides low privileges in MasterStudy LMS, plus a victim who views the stored malicious content. The CVSS vector indicates network reachability, low attack complexity, low privileges required, and user interaction required.
Are installations running version 3.7.52 affected?
Yes. The affected range includes MasterStudy LMS through version 3.7.52; the available data does not identify a fixed version.
What is the likely impact of successful exploitation?
Successful stored XSS can affect confidentiality, integrity, and availability at low impact levels, with the impact extending beyond the vulnerable component's security authority. Because the payload is stored, it may execute when another user later views the affected content.