{"id":"CVE-2026-82846","title":"The Masteriyo LMS  WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scriptin…","summary":"The Masteriyo LMS  WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scriptin…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82846","references":[{"url":"https://wpscan.com/vulnerability/0ee2052c-90a8-4b98-947a-adc55feb1de7/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00235,"epssPercentile":0.14793,"ingestedAt":"2026-09-06T05:50:39.343Z","slug":"CVE-2026-82846","body":"## Overview\n\nThe Masteriyo LMS  WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8270,"id":"CVE-2026-82846","ts":1788919995233,"field":"cvss","old":null,"new":"6.8"},{"seq":8269,"id":"CVE-2026-82846","ts":1788919995233,"field":"severity","old":"none","new":"medium"},{"seq":8079,"id":"CVE-2026-82846","ts":1788919281100,"field":"cvss","old":"6.8","new":null},{"seq":8078,"id":"CVE-2026-82846","ts":1788919281100,"field":"severity","old":"medium","new":"none"},{"seq":7888,"id":"CVE-2026-82846","ts":1788916356323,"field":"cvss","old":null,"new":"6.8"},{"seq":7887,"id":"CVE-2026-82846","ts":1788916356323,"field":"severity","old":"none","new":"medium"},{"seq":7697,"id":"CVE-2026-82846","ts":1788915297800,"field":"cvss","old":"6.8","new":null},{"seq":7696,"id":"CVE-2026-82846","ts":1788915297800,"field":"severity","old":"medium","new":"none"},{"seq":7506,"id":"CVE-2026-82846","ts":1788912716956,"field":"cvss","old":null,"new":"6.8"},{"seq":7505,"id":"CVE-2026-82846","ts":1788912716956,"field":"severity","old":"none","new":"medium"},{"seq":7315,"id":"CVE-2026-82846","ts":1788911331746,"field":"cvss","old":"6.8","new":null},{"seq":7314,"id":"CVE-2026-82846","ts":1788911331746,"field":"severity","old":"medium","new":"none"},{"seq":7119,"id":"CVE-2026-82846","ts":1788909078594,"field":"cvss","old":null,"new":"6.8"},{"seq":7118,"id":"CVE-2026-82846","ts":1788909078594,"field":"severity","old":"none","new":"medium"},{"seq":6931,"id":"CVE-2026-82846","ts":1788907391827,"field":"cvss","old":"6.8","new":null},{"seq":6930,"id":"CVE-2026-82846","ts":1788907391827,"field":"severity","old":"medium","new":"none"},{"seq":6733,"id":"CVE-2026-82846","ts":1788905444516,"field":"cvss","old":null,"new":"6.8"},{"seq":6732,"id":"CVE-2026-82846","ts":1788905444516,"field":"severity","old":"none","new":"medium"},{"seq":6551,"id":"CVE-2026-82846","ts":1788903460040,"field":"cvss","old":"6.8","new":null},{"seq":6550,"id":"CVE-2026-82846","ts":1788903460040,"field":"severity","old":"medium","new":"none"},{"seq":6337,"id":"CVE-2026-82846","ts":1788901810870,"field":"cvss","old":null,"new":"6.8"},{"seq":6336,"id":"CVE-2026-82846","ts":1788901810870,"field":"severity","old":"none","new":"medium"},{"seq":6167,"id":"CVE-2026-82846","ts":1788899562432,"field":"cvss","old":"6.8","new":null},{"seq":6166,"id":"CVE-2026-82846","ts":1788899562432,"field":"severity","old":"medium","new":"none"},{"seq":6035,"id":"CVE-2026-82846","ts":1788898240504,"field":"cvss","old":null,"new":"6.8"},{"seq":6034,"id":"CVE-2026-82846","ts":1788898240504,"field":"severity","old":"none","new":"medium"}]}