CVE-2026-82846

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.0

Description Insufficient sanitization and escaping of course settings allow users with a course-author role or higher to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when arbitrary web scripts are injected into pages available to all visitors, executing in the session of anyone viewing the course, including logged-in administrators. Stored Cross-Site Scripting is a flaw where malicious scripts are permanently stored on the target server.

Recommendations Update to version 3.4.0 or later.