CVE-2026-81338 — MEDIUM (4.6)

Vulnerability Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-345

References

https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/

FAQ

What is CVE-2026-81338?

CVE-2026-81338 is a vulnerability with a CVSS score of 4.6 (MEDIUM). The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing ...

How severe is CVE-2026-81338?

CVE-2026-81338 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-81338?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.