The Masteriyo LMS WordPress plugin versions prior to 2.3.3 contain a stored Cross-Site Scripting (CWE-79) vulnerability. The plugin fails to sanitize and escape quiz field content before rendering it on pages. Additionally, the instructor role is granted the capability to store unfiltered HTML, enabling stored XSS attacks. This vulnerability allows an attacker with instructor privileges to inject malicious scripts that execute in the context of any visitor viewing the affected page, including administrators. Multisite installations and sites with DISALLOW_UNFILTERED_HTML defined are not affected because the capability to store unfiltered HTML is not granted in those environments.

An attacker with instructor role privileges can inject malicious scripts via quiz fields that are stored and later executed in the browsers of any visitors to the affected page, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the context of the victim's browser. The vulnerability is limited to default single-site installations where the instructor role has unfiltered HTML capabilities.

No official patch or fix is currently confirmed. Users should upgrade to Masteriyo LMS version 2.3.3 or later once available, as the vulnerability affects versions before 2.3.3. Sites running multisite configurations or defining DISALLOW_UNFILTERED_HTML are not affected. Until a fix is available, restricting instructor role capabilities or disabling unfiltered HTML may mitigate the risk.