CVE-2026-19712

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

CVE-2026-19712

CVE-2026-19712 concerns the Masteriyo LMS WordPress plugin prior to 2.3.3. The issue: a quiz field is not sanitized or escaped before output, and instructors can store unfiltered HTML, enabling Stored XSS against page visitors, including administrators. Affected scope is default single-site insta...