# CVE-2026-59513: Masteriyo LMS Subscriber Cross Site Scripting

Source: https://junglewise.ai/threats/cve-2026-59513-masteriyo-lms-subscriber-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-59513 · Severity: medium · CVSS 6.5 · Published 2026-07-23

Masteriyo - LMS is a WordPress plugin used to create and manage online learning courses. A security vulnerability in versions 2.3.0 and earlier allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. If an administrator or another user views the affected content, these scripts could be used to redirect visitors to malicious sites, display unauthorized advertisements, or potentially compromise user sessions.

## Quick answers

**Is CVE-2026-59513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59513 being exploited in the wild.

**How severe is CVE-2026-59513?** Medium severity, with a CVSS score of 6.5, published 23 July 2026.

**Which products and versions are affected?** Masteriyo Masteriyo - LMS <= 2.3.0.

**Is there a fix for CVE-2026-59513?** A patch was published on 2026-07-21: Version 2.3.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59513?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Masteriyo - LMS plugin for WordPress (versions <= 2.3.0) due to improper neutralization of input during web page generation. An attacker with Subscriber-level privileges can inject malicious JavaScript payloads into the application. Because the vulnerability is 'Stored' or 'Reflected' with a scope change (S:C), the script executes in the context of other users, including administrators, when they interact with the affected page. This requires minimal user interaction (viewing a page) and is reachable over the network. The issue is resolved in version 2.3.1.

## Affected products

- Masteriyo Masteriyo - LMS <= 2.3.0

## Timeline

- 2026-06-26: other: Reported by K. Sorrachat
- 2026-07-21: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD
- 2026-07-21: patched: Version 2.3.1 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve)