CVE-2026-82846: Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

Q: Who needs access to exploit this issue?

An attacker needs a course-author role or higher in the plugin to submit malicious content through affected course settings.

Q: Which users are at risk when malicious content has been stored?

Anyone who views the affected course page can execute the stored script in their browser. This includes logged-in administrators who view the course.

Q: What version should be used to remediate the issue?

The supplied vulnerability description states that versions before 3.4.0 are affected. Upgrade the Masteriyo LMS plugin to version 3.4.0 or later.

Published Sep 5, 2026

Updated

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.

Affected Software

1 affected component

Masteriyo Masteriyo LMS WordPress plugin<3.4.0

Event History

Sep 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who needs access to exploit this issue?

An attacker needs a course-author role or higher in the plugin to submit malicious content through affected course settings.

Which users are at risk when malicious content has been stored?

Anyone who views the affected course page can execute the stored script in their browser. This includes logged-in administrators who view the course.

What version should be used to remediate the issue?

The supplied vulnerability description states that versions before 3.4.0 are affected. Upgrade the Masteriyo LMS plugin to version 3.4.0 or later.