The Masteriyo LMS WordPress plugin versions prior to 2.3.3 fail to sanitize and escape user input in a quiz field, combined with the instructor role's ability to store unfiltered HTML. This combination enables stored Cross-Site Scripting (CWE-79) attacks, allowing malicious instructors to inject scripts that execute in the browsers of any visitors to the affected page, including administrators. Multisite installations and sites defining DISALLOW_UNFILTERED_HTML are not affected because the instructor role does not have the capability to store unfiltered HTML in those configurations.

Successful exploitation allows an attacker with instructor privileges to execute arbitrary JavaScript in the context of the affected site for any visitor of the vulnerable page, potentially leading to session hijacking, privilege escalation, or other malicious actions. The impact is limited to confidentiality and integrity (partial), with no direct availability impact. The vulnerability is rated medium severity with a CVSS score of 6.1.

No official patch or remediation level has been confirmed yet. Users should upgrade to Masteriyo LMS version 2.3.3 or later once available. In the meantime, multisite installations or defining DISALLOW_UNFILTERED_HTML can mitigate the risk by removing the capability that allows unfiltered HTML storage by instructors. Monitor the vendor advisory for updates on official fixes.