CVE-2026-82847: Masteriyo LMS WordPress XSS Vulnerability

CVE-2026-82847 Overview

CVE-2026-82847 is a Stored Cross-Site Scripting (XSS) vulnerability in the Masteriyo LMS WordPress plugin versions prior to 3.4.1. The plugin fails to sanitize and escape a course field before rendering it back in the course editor. Authenticated users with the instructor role can inject persistent JavaScript payloads that execute in the browsers of higher-privileged users, including administrators. Successful exploitation allows session theft, administrative action forgery, and complete site takeover once an administrator views the affected course. The flaw is tracked under CWE-79 and was reported through the WPScan Vulnerability Report.

Critical Impact
An authenticated instructor can execute arbitrary JavaScript in an administrator's browser, leading to account compromise and full WordPress site takeover.

Affected Products

Masteriyo LMS WordPress plugin versions prior to 3.4.1
WordPress installations using the affected plugin with the instructor role enabled
Sites where administrators access the course editor to review instructor-created content

Discovery Timeline

2026-09-12 - CVE-2026-82847 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82847

Vulnerability Analysis

The vulnerability resides in the course editor component of the Masteriyo LMS plugin. One of the course fields accepts user-supplied input without applying output escaping when the value is rendered back in the editor interface. An instructor with legitimate access to course creation can embed HTML or JavaScript within this field. When an administrator or another higher-privileged user opens the affected course in the editor, the payload executes in their authenticated session context.

Stored XSS in an administrative WordPress interface is particularly dangerous because administrators possess plugin installation, user creation, and theme editing privileges. An attacker payload can leverage the WordPress REST API to create new administrator accounts, install backdoored plugins, or exfiltrate authentication cookies.

Root Cause

The underlying defect is missing input sanitization and output escaping for a course field within the editor rendering path. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for context-appropriate output encoding, but the vulnerable code path emits the stored value directly into the HTML response. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack requires an authenticated user account holding the instructor role. The attacker creates or edits a course, injecting a JavaScript payload into the vulnerable field. The payload persists in the WordPress database. When an administrator later opens the course in the editor for review, publishing, or moderation, the browser parses and executes the injected script under the administrator's origin and session. User interaction from the privileged victim is required, which is reflected in the CVSS vector requiring UI:R.

See the WPScan Vulnerability Report for the specific vulnerable field and payload proof of concept.

Detection Methods for CVE-2026-82847

Indicators of Compromise

Course records in the WordPress database containing <script>, onerror=, onload=, or javascript: sequences in course editor fields
Unexpected new administrator accounts created shortly after an administrator opened a course edited by an instructor
Plugin or theme file modifications timestamped near administrator course review activity
Outbound HTTP requests from the WordPress server or administrator browser to unfamiliar domains following course editor access

Detection Strategies

Query the wp_posts and Masteriyo custom tables for course entries containing HTML event handlers or script tags in stored fields
Review WordPress audit logs for course create and update events performed by instructor-role accounts, correlated with subsequent administrator editor sessions
Inspect web server access logs for administrator requests to the course editor followed by anomalous REST API calls under the same session

Monitoring Recommendations

Enable a WordPress activity log plugin to capture role changes, user creation, and plugin installation events
Alert on creation of new users with the administrator role outside of documented change windows
Monitor the plugin version in use across all WordPress sites and flag any Masteriyo LMS installations below 3.4.1

How to Mitigate CVE-2026-82847

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to version 3.4.1 or later on all WordPress sites
Audit all accounts assigned the instructor role and remove or restrict any that are not required
Review recently edited courses for suspicious HTML or script content in editor fields and sanitize or delete affected records
Rotate administrator passwords and invalidate active sessions if instructor-created content was reviewed prior to patching

Patch Information

The vendor addressed the vulnerability in Masteriyo LMS version 3.4.1 by adding proper sanitization and output escaping on the affected course field. Administrators should apply the update through the WordPress plugin dashboard or by downloading the fixed release. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the instructor role assignment to fully trusted users until the patch is applied
Deploy a Web Application Firewall (WAF) with rules that block script tags and event handlers in POST bodies targeting Masteriyo course endpoints
Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to limit inline script execution

bash

# Configuration example
# Update the Masteriyo LMS plugin via WP-CLI
wp plugin update learning-management-system --version=3.4.1

# Verify the installed version
wp plugin get learning-management-system --field=version