CVE-2026-0559

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0559", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-01T21:48:26.915Z", "datePublished": "2026-02-14T06:42:32.152Z", "dateUpdated": "2026-04-08T17:16:07.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:07.986Z"}, "affected": [{"vendor": "stylemix", "product": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1146350-4491-4fa0-8b78-6dbc00903160?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435814/masterstudy-lms-learning-management-system"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-12-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-01T22:05:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T18:22:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:36:37.965017Z", "id": "CVE-2026-0559", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:46:21.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0559", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:37.965017Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:38.586Z"}}], "cna": {"title": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "stylemix", "product": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.7.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-01T22:05:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T18:22:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1146350-4491-4fa0-8b78-6dbc00903160?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435814/masterstudy-lms-learning-management-system"}], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:07.986Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0559", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:16:07.986Z", "dateReserved": "2026-01-01T21:48:26.915Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T06:42:32.152Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education", "vendor": "stylemix", "versions": [{"lessThanOrEqual": "3.7.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin de WordPress MasterStudy LMS \u2013 para cursos y educaci\u00f3n en l\u00ednea es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'stm_lms_courses_grid_display' del plugin en todas las versiones hasta la 3.7.11, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-0559", "lastModified": "2026-06-17T10:10:56.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0559", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:36:37.965017Z", "version": "2.0.3"}}]}, "published": "2026-02-14T07:16:08.240", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3435814/masterstudy-lms-learning-management-system"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1146350-4491-4fa0-8b78-6dbc00903160?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.11]"}}], "product": "masterstudy_lms_wordpress_plugin_\u2013_for_online_courses_and_education", "vendor": "stylemix"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:51:04.399873+00:00", "value": {"mitigation_remediation": ["Update the MasterStudy LMS plugin to the latest version released by the vendor.", "Remove or delete the stm_lms_courses_grid_display shortcode from any posts or pages where it is used, or replace it with a sanitized version.", "Restrict contributor\u2011level or higher accounts until the plugin is fully updated, or consider temporarily removing editor roles for existing contributors."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via plugin shortcode"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education installed, in any version up to and including 3.7.11. No specific patch version is indicated, so all installations of these versions are vulnerable until a newer plugin release is applied.", "description_and_impact": "The MasterStudy LMS WordPress Plugin allows a stored XSS flaw in the stm_lms_courses_grid_display shortcode. The plugin fails to sanitize or escape user\u2011supplied attributes, meaning an authenticated contributor can insert arbitrary JavaScript that is persisted. When a page containing the affected shortcode is viewed, the injected script runs in the context of the visitor\u2019s session. Based on this behavior, it is inferred that an attacker could hijack sessions, deface the site, or deliver other malicious payloads, as these are typical outcomes of stored XSS.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1\u202f% signals a low probability of exploitation in the wild. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a contributor\u2011level account or higher; no remote public access is needed. Once a malicious script is stored via the shortcode, any user who visits a page containing that shortcode will execute the script in their browser session. The likely impacts on confidentiality and integrity of site content are inferred from typical stored XSS effects, potentially including session hijacking, defacement, or malicious payload delivery, but the exact scope cannot be determined from the available data."}}}}, "created": "2026-02-16T12:02:10.348347+00:00", "updated": "2026-04-16T07:00:10.981779+00:00", "vendors": ["stylemix", "stylemix$PRODUCT$masterstudy_lms_wordpress_plugin_\u2013_for_online_courses_and_education", "wordpress", "wordpress$PRODUCT$wordpress"]}