CVE-2026-82846: Unknown Masteriyo Lms

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.

Affected products

• Unknown Masteriyo Lms: from 1.18.0, before 3.4.0 (fixed in 3.4.0)

Published 2026-09-05. Last modified 2026-09-08.