Stored Cross-Site Scripting Vulnerability in Masteriyo LMS Plugin for WordPress
CVE-2026-82846

6.8MEDIUM

Key Information:

Vendor

WordPress
Status
Masteriyo Lms
Vendor
CVE Published:
5 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-82846?

The Masteriyo LMS WordPress plugin prior to version 3.4.0 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper sanitization and escaping of certain course settings. This flaw allows users with a course-author role to inject malicious scripts into the output, which can then execute in the session of any visitor viewing the affected course page, including logged-in administrators. This presents a significant security risk as it can lead to unauthorized information access or modification.

Affected Version(s)

Masteriyo LMS 1.18.0 < 3.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-82846 - Proof of Concept

References

https://wpscan.com/vulnerability/0ee2052c-90a8-4b98-947a-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mutantgun
WPScan
.