This vulnerability (CVE-2026-59513) is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). It affects Masteriyo - LMS software versions up to 2.3.0. The vulnerability allows a subscriber-level user to inject malicious scripts, which could lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The CVSS 3.1 score is 6.5 (medium severity), with network attack vector, low attack complexity, requiring privileges and user interaction, and scope change. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system or user data. The CVSS vector indicates that the attack requires user interaction and privileges but can be performed remotely with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting subscriber input capabilities and monitor for suspicious activity related to script injection. Avoid granting unnecessary privileges to subscriber roles where possible.