Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-81338

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-81338

Published

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-81338

Published

MasterStudy LMS WordPress Plugin

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "MasterStudy LMS WordPress Plugin",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "3.7.50"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON