Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-09-23T06:17:02.150Z",
  "pubdate": "2026-09-23T06:17:02.150Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin prior to version 3.7.50 contains a critical vulnerability involving improper input sanitization and output escaping. This flaw allows authenticated users with subscriber-level permissions or higher to inject arbitrary HTML, including malicious iframes, into stored content.\nThe vulnerability is classified as Stored Cross-Site Scripting (XSS). When a victim, such as an administrator or another user, views the compromised content, the injected payload executes within their browser session.\nThe primary risk implications include the potential for sophisticated phishing campaigns, unauthorized content spoofing, and the execution of malicious scripts. Because the injected HTML is rendered directly to other users, attackers can manipulate the appearance of the interface to deceive users or perform unauthorized actions on their behalf, potentially leading to account takeover or further system compromise.\nExploitation requires active authentication on the target WordPress instance, specifically a subscriber-level account or higher. Given the commonality of subscriber registration in LMS platforms, this vulnerability poses a significant threat to the integrity and security of the learning environment.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input validation and server-side sanitization on user-supplied content within the MasterStudy LMS plugin. Specifically, the plugin components responsible for handling user submissions do not enforce strict whitelist-based filtering, allowing the injection of restricted HTML tags and attributes into the database.\nWhen a user with subscriber privileges or higher submits content, the application fails to sanitize inputs such as iframe tags. These inputs are subsequently stored directly in the WordPress database without modification. The lack of output encoding ensures that when this stored data is retrieved and rendered to other users via the plugin's front-end interfaces, the injected HTML is interpreted by the browser as legitimate content.\nThe attack flow proceeds as follows: First, an attacker logs into the application using a subscriber-level account. Second, the attacker locates an input field or content submission mechanism provided by the MasterStudy LMS plugin that does not restrict HTML tags. Third, the attacker inserts a payload containing malicious HTML elements, such as <iframe src=\"[malicious_url]\" />, into the input field. Fourth, the server accepts and stores this malicious content. Fifth, when a target user or administrator views the page where the compromised content is displayed, the browser renders the attacker-supplied iframe.\nThis behavior facilitates phishing by allowing an attacker to overlay legitimate interface elements with fraudulent forms designed to capture credentials. Furthermore, content spoofing is trivial as the attacker can manipulate the DOM to alter the visual presentation of course information or user dashboards. Since the payload is stored persistently, it remains active until the record is deleted or the plugin is patched, consistently threatening any user who accesses the compromised view.\nThis vulnerability is present in all versions of the MasterStudy LMS plugin before 3.7.50. The attack surface is exposed via any web-based interface handled by the plugin that reflects user-submitted input back to other users. No special privileges beyond standard subscriber access are required, making this a low-barrier-to-entry exploit within the WordPress ecosystem."
}