CVE-2026-82847 is a stored XSS vulnerability in the Masteriyo LMS WordPress plugin prior to version 3.4.1. The vulnerability occurs due to improper sanitization and escaping of a course field before rendering it in the course editor interface. Users with the instructor role can exploit this to inject malicious scripts that execute when administrators or other privileged users view the affected course content, potentially leading to session hijacking or other script-based attacks.

Users with the instructor role can perform stored XSS attacks against administrators or other higher privileged users by injecting malicious scripts into a course field. This could lead to unauthorized actions performed by administrators, theft of sensitive information, or compromise of administrative accounts. The vulnerability affects the confidentiality and integrity of the affected WordPress site.

Upgrade the Masteriyo LMS plugin to version 3.4.1 or later, where this vulnerability is fixed. There is no indication that any temporary or alternative mitigations exist, so applying the official update is required to remediate the issue.