CVE-2026-82846: CWE-79 Cross-Site Scripting (XSS) in Masteriyo LMS

The Masteriyo LMS WordPress plugin before version 3.4.0 does not properly sanitize and escape certain course settings before rendering them on publicly accessible pages. This flaw permits users with the course-author role to perform stored XSS attacks, executing arbitrary scripts in the context of any user viewing the course page, potentially compromising user sessions and data. The CVSS 3.1 base score is 6.8, indicating a medium severity vulnerability with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation allows an attacker with course-author privileges to execute arbitrary JavaScript in the browsers of users who view the affected course pages, including administrators. This can lead to session hijacking, credential theft, or other malicious actions performed with the victim's privileges.

No official patch or remediation has been confirmed or published yet. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restrict course-author role assignments to trusted users and consider limiting access to course pages to reduce exposure.