CVE-2026-105079: MasterStudy LMS Stored XSS Vulnerability

CVE-2026-105079 Overview

CVE-2026-105079 is a stored cross-site scripting (XSS) vulnerability in the StylemixThemes MasterStudy LMS plugin for WordPress. The flaw affects the masterstudy-lms-learning-management-system plugin from unspecified early versions through 3.7.52. The issue is tracked under CWE-79, covering improper neutralization of input during web page generation. An authenticated attacker with low privileges can inject malicious script content that persists on the server and executes in the browsers of other users who view the affected page.

Critical Impact
Authenticated attackers can inject persistent JavaScript into MasterStudy LMS pages, leading to session theft, administrative action hijacking, and account takeover through victim interaction.

Affected Products

StylemixThemes MasterStudy LMS plugin for WordPress
masterstudy-lms-learning-management-system versions up to and including 3.7.52
WordPress sites running MasterStudy LMS with user-generated content features enabled

Discovery Timeline

2026-10-08 - CVE-2026-105079 published to NVD
2026-10-10 - Last updated in NVD database

Technical Details for CVE-2026-105079

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the MasterStudy LMS plugin. The plugin fails to properly neutralize user-supplied input before writing it into HTML output rendered to other users. Because the injected payload is persisted server-side, every subsequent visitor to the affected page executes attacker-controlled JavaScript in their browser session.

Exploitation requires low-privileged authentication and user interaction, and the scope is changed. A changed scope means the injected script executes in a security context different from the vulnerable component, amplifying the reach of the attack across the WordPress site. Successful exploitation can expose session cookies, forge requests on behalf of administrators, and modify course or user data within the LMS.

Root Cause

The root cause is missing or insufficient output encoding on input accepted through plugin-provided forms or editor fields. Input traverses the request handler and is stored in the WordPress database without escaping HTML control characters. When the data is later rendered, the browser interprets the stored content as executable markup rather than inert text, enabling script execution.

Attack Vector

An authenticated user with instructor, student, or similar low-privileged plugin role submits content containing JavaScript payloads through a plugin field that lacks sanitization. The payload is stored and served to any user who loads the affected view, including site administrators. See the Patchstack XSS Vulnerability Detail for the specific affected parameters.

Detection Methods for CVE-2026-105079

Indicators of Compromise

Stored content in MasterStudy LMS database tables containing <script>, onerror=, onload=, or javascript: tokens
Unexpected outbound requests from authenticated administrator sessions to attacker-controlled domains
New WordPress administrator accounts or role changes shortly after an authenticated user views LMS pages
Unexplained modifications to course content, user profiles, or plugin settings

Detection Strategies

Audit wp_posts, wp_postmeta, and MasterStudy-specific tables for HTML or script tags in fields expected to hold plain text
Monitor web server logs for POST requests to MasterStudy LMS endpoints containing encoded script payloads
Deploy Content Security Policy (CSP) report-only headers to surface inline script execution attempts
Correlate administrator browser telemetry with LMS page views to detect anomalous script execution

Monitoring Recommendations

Enable WordPress audit logging for plugin content changes and role modifications
Alert on administrator session cookies being transmitted to non-WordPress origins
Track plugin version inventory across managed WordPress deployments to confirm patched state

How to Mitigate CVE-2026-105079

Immediate Actions Required

Update the MasterStudy LMS plugin to a version released after 3.7.52 that addresses the vulnerability
Audit all low-privileged user accounts that could have submitted content to the plugin
Review stored LMS content for existing malicious payloads and sanitize affected records
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

StylemixThemes released a fixed version addressing the stored XSS flaw. Review the Patchstack advisory for the patched release and upgrade guidance. Apply the update through the WordPress plugin manager or by deploying the updated plugin archive.

Workarounds

Restrict account creation and limit the plugin roles that can submit rich content until the patch is applied
Deploy a Web Application Firewall (WAF) rule to block script tags and common XSS payload patterns targeting MasterStudy LMS endpoints
Enforce a strict Content Security Policy that disallows inline script execution on WordPress administrative and LMS pages
Disable or hide plugin features that accept HTML input from untrusted roles

bash

# Configuration example: WordPress CLI to update the plugin
wp plugin update masterstudy-lms-learning-management-system
wp plugin get masterstudy-lms-learning-management-system --field=version