Is CVE-2026-57330 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57330 being exploited in the wild.

How severe is CVE-2026-57330?

Medium severity, with a CVSS score of 6.5, published 29 June 2026.

Which products and versions are affected?

StylemixThemes MasterStudy LMS <= 3.7.27.

Is there a fix for CVE-2026-57330?

A patch was published on 2026-06-29: Fixed in version 3.7.28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57330 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57330?

Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57330: StylemixThemes MasterStudy LMS Cross-Site Scripting via Subscriber role

Q: Is there a fix for CVE-2026-57330?

A patch was published on 2026-06-29: Fixed in version 3.7.28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57330 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57330?

Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57330 · Severity: medium · CVSS 6.5 · Published 2026-06-29

MasterStudy LMS is a popular WordPress plugin used to create and manage online courses and learning platforms. A security vulnerability in versions 3.7.27 and earlier allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. If a site administrator or another user views the affected content, the attacker could potentially hijack sessions, redirect visitors to malicious websites, or deface the platform.

Technologies: StylemixThemes MasterStudy LMS. Vendors: StylemixThemes.

Quick answers

Is CVE-2026-57330 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57330 being exploited in the wild.
How severe is CVE-2026-57330?: Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?: StylemixThemes MasterStudy LMS <= 3.7.27.
Is there a fix for CVE-2026-57330?: A patch was published on 2026-06-29: Fixed in version 3.7.28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57330 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57330?: Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the MasterStudy LMS plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows authenticated attackers with Subscriber-level privileges to inject arbitrary web scripts. Successful exploitation requires a victim (such as an administrator) to interact with the malicious payload, leading to script execution in the context of the victim's browser. This is classified as a stored XSS vulnerability with a scope change (S:C). The issue is resolved in version 3.7.28.

Affected products

StylemixThemes MasterStudy LMS <= 3.7.27

Timeline

2026-04-15: disclosed: Reported by researcher endy
2026-06-29: advisory
2026-06-29: patched: Fixed in version 3.7.28

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.