CVE-2026-119478 · Package
NO FIX YET · SEE WHAT TO DO
The MasterStudy LMS WordPress plugin does not neutralize script-related HTML tags in a web page, so injected markup can run in a visitor's browser. An attacker who can get such content into the site can run JavaScript under the context of other users, including staff.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MasterStudy LMS WordPress plugin at version 3.7.56 or earlier are in the affected range. The sources do not say which input or role triggers the injection, so unknown what level of access an attacker needs.
Not affected if plugin-not-installed
Who cares masterstudy-lms, self-hosted, wordpress
masterstudy-lms-learning-management-system/ against the affected range through 3.7.56.3.7.56 (the sources give no exact fixed version).Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.