WordPress Masteriyo LMS plugin < 2.3.3 - Instructor+ Stored XSS via Quiz Description vulnerability

Instructor+ Stored XSS via Quiz Description vulnerability discovered by Farid Narimanov in WordPress Plugin Masteriyo - LMS versions 2.3.3...

CVE-2026-19712 Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

CVE-2026-19712 Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

PT-2024-15374

Name of the Vulnerable Software and Affected Versions RRJ Nueva Ecija Engineer Online Portal version 1.0 Description A vulnerability was found in the RRJ Nueva Ecija Engineer Online Portal, affecting some unknown processing of the file add quiz.php of the component Quiz Handler. The manipulation ...

CVE-2021-42664

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

CVE-2021-42664

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

CVE-2021-42664

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

PT-2021-23645

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A Stored Cross Site Scripting XSS issue exists in the Sourcecodester Engineers Online Portal in PHP. This is due to the quiz title and quiz description paramete...

CVE-2021-42664: Improper Neutralization of Input During Web Page Generation

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

Engineers Online Portal 跨站脚本漏洞

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to run javascript commands via the addquiz.php quiz title and quiz description...