This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Masteriyo LMS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 16 Aug 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Sun, 16 Aug 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there. | |
| Title | Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-08-16T06:00:16.021Z
Reserved: 2026-08-13T11:05:28.685Z
Link: CVE-2026-19712
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-16T06:16:52.207
Modified: 2026-08-16T06:16:52.207
Link: CVE-2026-19712
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-16T07:30:04Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')