CVE-2026-81338 — MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

CVE-2026-81338

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 0 before 3.7.50

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.