CVE-2026-105079: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StylemixThemes MasterStudy LMS

This vulnerability in MasterStudy LMS involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). The flaw affects all versions from initial release through 3.7.52. Exploitation requires some level of privileges (PR:L) and user interaction (UI:R), and it impacts confidentiality, integrity, and availability to a limited extent (C:L/I:L/A:L). No known exploits are reported in the wild. The vulnerability was published on 2026-10-08.

Successful exploitation could allow an attacker with limited privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, exploitation requires user interaction and some privileges, limiting the attack scope.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user input where possible and apply standard XSS mitigations in the environment.