CVE-2026-82847: Unknown Masteriyo Lms

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.

Affected products

• Unknown Masteriyo Lms: before 3.4.1 (fixed in 3.4.1)

Published 2026-09-12. Last modified 2026-09-14.