CVE-2026-81338: MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.50
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a WordPress account with at least the Subscriber role. The vulnerable input is course discussion content submitted through MasterStudy LMS.
What is the likely impact on people viewing malicious content?
Stored HTML such as embedded iframes can be rendered to users who view the affected discussion content. This can be used for phishing or to spoof content presented to those users.
Are sites using the plugin affected by default?
The provided information identifies MasterStudy LMS versions before 3.7.50 as affected, but does not state whether course discussions are enabled by default. Exposure requires users to be able to submit course discussion content and other users to view it.
What can be done before updating?
Restrict untrusted users from submitting course discussion content, especially Subscriber accounts, and review existing discussion posts for embedded HTML or iframes. Updating to version 3.7.50 or later addresses the affected version range.