Stored HTML Injection in MasterStudy LMS WordPress Plugin
CVE-2026-81338

Currently unrated

Key Information:

Vendor

WordPress
Status
Masterstudy Lms WordPress Plugin
Vendor
CVE Published:
23 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81338?

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 fails to adequately sanitize and restrict HTML content submitted by users. This vulnerability allows individuals with subscriber-level accounts and higher to inject HTML, including iframes, into user-generated content. The compromised HTML can be rendered to other users, potentially enabling phishing attempts and content spoofing, resulting in serious security risks for users interacting with the affected content.

Affected Version(s)

MasterStudy LMS WordPress Plugin 0 < 3.7.50

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81338 - Proof of Concept

References

https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jaime F. Murillo
WPScan
.