Description

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-12T06:16:26.147Z",
  "pubdate": "2026-09-12T06:16:26.147Z",
  "executiveSummary": "The Masteriyo LMS WordPress plugin, in versions prior to 3.4.1, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw originates from improper input sanitization and output escaping within specific course-related fields.\nAn authenticated attacker with the 'instructor' role can inject malicious JavaScript payloads into these fields.\nWhen these fields are rendered in the course editor, the malicious script executes within the context of the victim's session.\nThe primary impact involves the execution of unauthorized actions, potential session hijacking, or data theft when the victim is a higher-privileged user, such as an administrator.\nThe vulnerability requires an authenticated session with instructor-level privileges, limiting the initial attack vector but allowing for privilege escalation or administrative account compromise once triggered.\nSecurity teams should prioritize updating to version 3.4.1 or later to mitigate this risk.",
  "technicalDetails": "The vulnerability is classified as a Stored Cross-Site Scripting (XSS) flaw, stemming from the application's failure to sanitize and escape user-supplied data before rendering it in the WordPress administration dashboard.\nRoot Cause Analysis: The underlying issue exists within the handling of specific course fields provided by the Masteriyo LMS plugin. The plugin fails to apply adequate data sanitization during input processing and lacks appropriate output escaping functions (e.g., esc_html() or esc_attr()) when displaying these fields in the course editor interface. Consequently, malicious script tags, such as <script>alert(document.cookie)</script>, can be submitted and stored directly in the database.\nAttack Vector and Flow: An attacker must possess 'instructor' privileges to access the course creation or editing modules. The exploitation flow is as follows: 1) The attacker navigates to the course editor interface provided by Masteriyo LMS. 2) The attacker injects a crafted JavaScript payload into one of the vulnerable course fields. 3) The malicious input is saved into the database without validation. 4) When a high-privileged user (e.g., an administrator) accesses the course editor, the application retrieves the stored, unsanitized payload from the database and renders it directly into the HTML document. 5) The browser interprets the payload as legitimate code and executes it within the security context of the administrator's active session.\nPayload Behavior and Impact: Since the script executes in the context of the administrator's session, the payload can perform any action the administrator is authorized to execute. This includes, but is not limited to, modifying site settings, creating new administrator accounts, exfiltrating sensitive information, or redirecting users to malicious external domains. Because this is a stored XSS, the payload remains active every time the compromised course field is rendered until the input is manually purged from the database or the plugin is patched.\nAffected Components: The vulnerability is located within the administrative course editing component of Masteriyo LMS. It affects all versions prior to 3.4.1. Authentication is required to exploit this flaw, specifically necessitating a user account with sufficient instructor privileges, which typically provides the ability to manage course metadata.\nEnvironmental Context: The vulnerability is prevalent in environments where administrative users frequently review or edit content created by instructors. The lack of output encoding ensures that the malicious script persists across sessions, posing a significant risk of administrative account takeover."
}