Is CVE-2026-59513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59513 being exploited in the wild.

How severe is CVE-2026-59513?

Medium severity, with a CVSS score of 6.5, published 23 July 2026.

Which products and versions are affected?

Masteriyo Masteriyo - LMS <= 2.3.0.

Is there a fix for CVE-2026-59513?

A patch was published on 2026-07-21: Version 2.3.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59513 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59513?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59513: Masteriyo LMS Subscriber Cross Site Scripting

Q: Is there a fix for CVE-2026-59513?

A patch was published on 2026-07-21: Version 2.3.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59513 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59513?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59513 · Severity: medium · CVSS 6.5 · Published 2026-07-23

Masteriyo - LMS is a WordPress plugin used to create and manage online learning courses. A security vulnerability in versions 2.3.0 and earlier allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. If an administrator or another user views the affected content, these scripts could be used to redirect visitors to malicious sites, display unauthorized advertisements, or potentially compromise user sessions.

Quick answers

Is CVE-2026-59513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59513 being exploited in the wild.
How severe is CVE-2026-59513?: Medium severity, with a CVSS score of 6.5, published 23 July 2026.
Which products and versions are affected?: Masteriyo Masteriyo - LMS <= 2.3.0.
Is there a fix for CVE-2026-59513?: A patch was published on 2026-07-21: Version 2.3.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59513 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59513?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Masteriyo - LMS plugin for WordPress (versions <= 2.3.0) due to improper neutralization of input during web page generation. An attacker with Subscriber-level privileges can inject malicious JavaScript payloads into the application. Because the vulnerability is 'Stored' or 'Reflected' with a scope change (S:C), the script executes in the context of other users, including administrators, when they interact with the affected page. This requires minimal user interaction (viewing a page) and is reachable over the network. The issue is resolved in version 2.3.1.

Affected products

Masteriyo Masteriyo - LMS <= 2.3.0

Timeline

2026-06-26: other: Reported by K. Sorrachat
2026-07-21: advisory: Patchstack advisory published
2026-07-23: disclosed: CVE published to NVD
2026-07-21: patched: Version 2.3.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.