https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:00:14.436349+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-354586 EUVD-2026-354586 2026-10-09T15:00:14.486721+00:00 EUVD-2026-354586 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19712 fkie_cve-2026-19712 2026-10-09T15:00:14.486765+00:00

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.

 https://cve.radiocsirt.org/vuln/ghsa-9qrh-j6xc-w4qf GHSA-9qrh-j6xc-w4qf 2026-10-09T15:00:14.486801+00:00

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.