Quick answers
- Is CVE-2026-82847 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82847 being exploited in the wild.
- How severe is CVE-2026-82847?
- Medium severity, with a CVSS score of 6.8, published 12 September 2026.
- Which products and versions are affected?
- Masteriyo Masteriyo LMS before 3.4.1.
- Is there a fix for CVE-2026-82847?
- A patch was published on 2026-09-10: Fixed in version 3.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82847 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-82847?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Masteriyo LMS WordPress plugin before version 3.4.1. The vulnerable component is the course highlights field in the REST API endpoint /wp-json/masteriyo/v1/courses, which fails to sanitize and escape user input before storing it. An instructor-role user can inject arbitrary HTML and JavaScript through the highlights field via a PUT or POST request. Unlike the description field which properly escapes event handlers, the highlights field is stored verbatim and rendered as raw HTML in the course editor, allowing script execution in the administrator's browser session. This enables privilege escalation and administrative account compromise. The vulnerability was patched in version 3.4.1.
Affected products
- Masteriyo Masteriyo LMS before 3.4.1
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 3.4.1