CVE-2026-119478: WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

Q: Which versions are affected?

The issue affects MasterStudy LMS versions through 3.7.56. The available data does not identify a fixed version.

Q: What type of attack does this enable?

The vulnerability is classified as basic cross-site scripting and code injection caused by improper neutralization of script-related HTML tags. The provided information does not specify the affected input field, required privileges, or attack path.

Published Nov 7, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/masterstudy-lms-learning-management-system to a version that resolves this vulnerability.
Fixed in 3.7.57

Event History

Nov 7, 2026

CVE Published

via MITRE·10:19 AM

Data Sourced

via MITRE·10:19 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which versions are affected?

The issue affects MasterStudy LMS versions through 3.7.56. The available data does not identify a fixed version.

What type of attack does this enable?

The vulnerability is classified as basic cross-site scripting and code injection caused by improper neutralization of script-related HTML tags. The provided information does not specify the affected input field, required privileges, or attack path.