Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-16T06:16:52.207Z",
  "pubdate": "2026-08-16T06:16:52.207Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists within the Masteriyo LMS WordPress plugin prior to version 2.3.3. The security defect arises because the application fails to properly sanitize and escape a specific quiz field before rendering it back to users in the Document Object Model (DOM). Furthermore, the plugin inherently grants the instructor user role the capability to store unfiltered HTML within the platform.\nThis combination of improper input sanitization, inadequate output escaping, and broad permission assignment allows authenticated users assigned to the instructor role to inject malicious scripts into application data stores. When any visitor—including high-privileged administrators—accesses the affected page containing the rendered quiz field, the malicious payload executes within the context of their browser session.\nThe risk implications include potential session hijacking, unauthorized privilege escalation, and unauthorized actions performed on behalf of the victim. Exploitation is constrained to default single-site WordPress installations. Environments running WordPress multisite or explicitly defining the DISALLOW_UNFILTERED_HTML constant are not affected, as the underlying capability to store unfiltered HTML is suppressed in those configurations.",
  "technicalDetails": "The vulnerability stems from an input validation and output encoding flaw located within the quiz management functionality of the Masteriyo LMS WordPress plugin. Specifically, the affected component fails to enforce contextual output escaping or robust input sanitization on a dedicated quiz field prior to persisting the data into the database and subsequently reflecting it to end users.\nThe attack vector requires authenticated access with specific privilege requirements. An attacker must compromise or possess an account assigned to the instructor role within the WordPress application. Due to the privilege model implemented by the plugin, the instructor role is granted the capability to submit and store unfiltered HTML. When the instructor populates the vulnerable quiz field with malicious input containing arbitrary JavaScript payloads, the application accepts the data without stripping or neutralizing the executable script tags.\nThe step-by-step attack flow proceeds as follows: First, the malicious actor authenticates to the WordPress platform using credentials associated with the instructor role. Second, the actor navigates to the quiz creation or editing interface provided by the Masteriyo LMS plugin. Third, the actor injects a crafted Cross-Site Scripting payload (such as an event handler or script tag) into the vulnerable quiz field and saves the changes, resulting in the payload being stored directly in the database. Fourth, an unsuspecting victim or administrator navigates to the front-end page where the quiz is rendered. Fifth, the application retrieves the stored quiz data and outputs it directly into the HTML response without performing runtime sanitization or escaping.\nFinally, the victim's browser parses the HTTP response, interprets the injected payload as legitimate script code, and executes it within the context of the victim's active session. Depending on the privileges of the victim, this payload can perform arbitrary actions via the browser DOM, access sensitive session tokens, or interact with the WordPress REST API on behalf of the user."
}