Medium severity · published Sep 23, 2026
CVE-2026-81338
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
4.6
CVSS
0.1%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin ·
before 3.7.50 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81338
wpscan.com
https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/
More from MasterStudy LMS WordPress Plugin
8.8
CVE-2024-5973
MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
7.5
CVE-2023-4278
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
7.2
CVE-2026-88843
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
5.3
CVE-2026-88846
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-81199
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route