{"id":"CVE-2026-119478","kind":"vulnerability","aliases":["CVE-2026-119478"],"related":[],"title":"MasterStudy LMS WordPress plugin: stored XSS through script tags in pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.","summary":"The MasterStudy LMS WordPress plugin does not neutralize script-related HTML tags in a web page, so injected markup can run in a visitor's browser. An attacker who can get such content into the site can run JavaScript under the context of other users, including staff.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["masterstudy-lms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed MasterStudy LMS plugin version in the WordPress admin plugin list or the plugin header in `masterstudy-lms-learning-management-system/` against the affected range through 3.7.56.","fix":"- MasterStudy LMS: a version later than `3.7.56` (the sources give no exact fixed version).","status":"open","published_at":"2026-11-07T11:16:56+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:43+00:00","updated_at":"2026-11-07T11:48:43+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:43Z","model":"claude-haiku-5-5","output":{"fix":"- MasterStudy LMS: a version later than `3.7.56` (the sources give no exact fixed version).","reach":"internet","title":"MasterStudy LMS WordPress plugin: stored XSS through script tags in pages","impact":"medium","summary":"The MasterStudy LMS WordPress plugin does not neutralize script-related HTML tags in a web page, so injected markup can run in a visitor's browser. An attacker who can get such content into the site can run JavaScript under the context of other users, including staff.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","masterstudy-lms","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, possibly stealing sessions","analyst_note":"Find the fixed version and the vulnerable input from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119478 or the vendor advisory.","how_to_check":"- Check the installed MasterStudy LMS plugin version in the WordPress admin plugin list or the plugin header in `masterstudy-lms-learning-management-system/` against the affected range through 3.7.56.\n- unknown for further detection steps; the sources do not say how the input is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MasterStudy LMS WordPress plugin at version 3.7.56 or earlier are in the affected range. The sources do not say which input or role triggers the injection, so unknown what level of access an attacker needs.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4242,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119478':14A,17A '-2026':13A,16A '3.7.56':109C 'affect':103C 'allow':99C 'attack':54B 'basic':86C 'browser':52B 'code':100C 'content':59B 'context':68B 'cve':12A,15A 'get':57B 'host':24B 'html':37B,80C 'improp':74C 'includ':72B 'inject':44B 'injection.this':101C 'issu':102C 'javascript':65B 'learn':96C 'lms':2A,20B,28B,92C,95C,105C 'manag':97C 'markup':45B 'masterstudi':1A,19B,27B,91C,94C,104C 'masterstudy-lm':18B 'masterstudy-lms-learning-management-system':93C 'n/a':107C 'neutral':33B,75C 'packag':21B 'page':11A,42B,85C 'plugin':4A,30B 'relat':36B,79C 'run':47B,64B 'script':8A,35B,78C 'script-rel':34B,77C 'self':23B 'self-host':22B 'site':62B 'staff':73B 'store':5A 'stylemixthem':90C 'system':98C 'tag':9A,38B,81C 'user':71B 'visitor':50B 'vulner':88C 'web':41B,84C 'wordpress':3A,25B,29B 'xss':6A,87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MasterStudy LMS WordPress plugin at version 3.7.56 or earlier are in the affected range. The sources do not say which input or role triggers the injection, so unknown what level of access an attacker needs.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["masterstudylms","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119478':14A,17A '-2026':13A,16A 'cve':12A,15A 'lms':2A 'masterstudi':1A 'page':11A 'plugin':4A 'script':8A 'store':5A 'tag':9A 'wordpress':3A 'xss':6A","search_b":"'attack':54B 'browser':52B 'content':59B 'context':68B 'get':57B 'host':24B 'html':37B 'includ':72B 'inject':44B 'javascript':65B 'lms':20B,28B 'markup':45B 'masterstudi':19B,27B 'masterstudy-lm':18B 'neutral':33B 'packag':21B 'page':42B 'plugin':30B 'relat':36B 'run':47B,64B 'script':35B 'script-rel':34B 'self':23B 'self-host':22B 'site':62B 'staff':73B 'tag':38B 'user':71B 'visitor':50B 'web':41B 'wordpress':25B,29B","search_c":"'3.7.56':109C 'affect':103C 'allow':99C 'basic':86C 'code':100C 'html':80C 'improp':74C 'injection.this':101C 'issu':102C 'learn':96C 'lms':92C,95C,105C 'manag':97C 'masterstudi':91C,94C,104C 'masterstudy-lms-learning-management-system':93C 'n/a':107C 'neutral':75C 'page':85C 'relat':79C 'script':78C 'script-rel':77C 'stylemixthem':90C 'system':98C 'tag':81C 'vulner':88C 'web':84C 'xss':87C","first_public_at":"2026-11-07T11:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119478","severity":null,"published_at":"2026-11-07T11:16:56+00:00","modified_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}