Executive brief
Masteriyo LMS is a popular WordPress learning management plugin used to create and manage online courses. A flaw in the plugin fails to properly sanitize the course highlights field, allowing instructors to inject malicious JavaScript code that executes when administrators edit the course. An attacker with instructor credentials can use this to hijack administrator accounts and perform unauthorized actions on the website.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Masteriyo LMS WordPress plugin before version 3.4.1. The vulnerable component is the course highlights field in the REST API endpoint /wp-json/masteriyo/v1/courses, which fails to sanitize and escape user input before storing it. An instructor-role user can inject arbitrary HTML and JavaScript through the highlights field via a PUT or POST request. Unlike the description field which properly escapes event handlers, the highlights field is stored verbatim and rendered as raw HTML in the course editor, allowing script execution in the administrator's browser session. This enables privilege escalation and administrative account compromise. The vulnerability was patched in version 3.4.1.
Affected products
- Masteriyo Masteriyo LMS before 3.4.1
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 3.4.1