CVE-2026-81338

UNKNOWN 0.0

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

Vendor	unknown
Product	masterstudy lms wordpress plugin
Published	Sep 23, 2026

Stay Ahead of the Next One

Get instant alerts for unknown masterstudy lms wordpress plugin

Be the first to know when new unknown vulnerabilities affecting unknown masterstudy lms wordpress plugin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / MasterStudy LMS WordPress Plugin

0 < 3.7.50

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/

Credits

Jaime F. Murillo WPScan