CyberRota Analysis
AI-GeneratedThe Masteriyo LMS WordPress plugin prior to version 2.3.3 is vulnerable due to insufficient sanitization and escaping of quiz fields, enabling instructors to store unfiltered HTML. This flaw allows for Stored Cross-Site Scripting (XSS) attacks, potentially impacting all visitors, including administrators, on default single-site installations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.