Stored Cross-Site Scripting Vulnerability in MasterStudy LMS Plugin by WordPress

CVE-2026-0559

What is CVE-2026-0559?

The MasterStudy LMS WordPress Plugin designed for online courses is susceptible to Stored Cross-Site Scripting through the 'stm_lms_courses_grid_display' shortcode. This vulnerability arises from inadequate input validation and output escaping of user-supplied attributes. Authenticated attackers with contributor access or higher can exploit this flaw by injecting malicious web scripts into web pages. When users access these compromised pages, the scripts execute, potentially leading to various security implications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References