CVE-2026-82846
N/A PoC AVAILABLEThe Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
EXPLOIT AVAILABLE
Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.
Exploitation likelihood
—EPSS not yet scored
○ In CISA KEV
● Public exploit / PoC
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept & exploit code
- reference https://wpscan.com/vulnerability/0ee2052c-90a8-4b98-947a-adc55feb1de7/
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-82846/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-82846/poc.json
Weakness (CWE)
Not classified.
CVSS vector
Not yet scored.