Answer in brief
CVE-2026-19712 records a Unknown severity vulnerability in Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description. The current sources do not mark it as known exploited. The current feed maps Unknown/Masteriyo LMS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Masteriyo LMS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Masteriyo LMSgeneric | >=0 <2.3.3 | 2.3.3 |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-19712 records a Unknown severity vulnerability in Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description. The current sources do not mark it as known exploited. The current feed maps Unknown/Masteriyo LMS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Masteriyo LMS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Masteriyo LMSgeneric | >=0 <2.3.3 | 2.3.3 |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.
Quoted source text, attributed separately from HOL analysis.