CVE-2026-81338
Last modified
CVE-2026-81338 is a medium-severity vulnerability rated 4.6/10 on the CVSS scale. The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MasterStudy LMS WordPress Plugin | < 3.7.50 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-81338?
How severe is CVE-2026-81338?
How do I fix CVE-2026-81338?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81322Exposure of Sensitive Information to an Unauthorized Actor v…2.1
- CVE-2026-81326QND uses a hard-coded cryptographic key, which may allow a l…6.8
- CVE-2026-8133A security vulnerability has been detected in zyx0814 FilePr…7.3
- CVE-2026-81330The C6 ear camera transmits live video to the EarVision Andr…6.5
- CVE-2026-81334darknet subscripts its layer array with an index taken from …6.1
- CVE-2026-81335Baserow dispatches an Application Builder data source withou…7.5
- CVE-2026-81339The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3
- CVE-2026-8134Concrete CMS 9.5.0 and below fails to sanitize path traversa…7.2
- CVE-2026-81340The MasterStudy LMS WordPress Plugin WordPress plugin befor…3.8
- CVE-2026-81341wolfEngine before 1.4.1 sources the explicit AES-CCM nonce f…6.5
- CVE-2026-81342The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.7
- CVE-2026-81346The Frontend Admin by DynamiApps WordPress plugin before 3.2…4.3
Are you affected by CVE-2026-81338?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST