CVE-2023-35090 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS)

What is CVE-2023-35090?

CVE-2023-35090 is a medium-severity cross-site scripting vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education, published on 22 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.

Weakness: CWE-79

Which versions are affected by CVE-2023-35090?

It affects 1 product.

Products include Stylemixthemes Masterstudy Lms.

How do I fix CVE-2023-35090?

No fix has been published for CVE-2023-35090 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-35090 being exploited?

There is no known exploitation of CVE-2023-35090 in the wild and no public exploit code.

Other vulnerabilities in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education

• CVE-2024-3136 MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Critical 9.8
• CVE-2024-2409 MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Critical 9.8
• CVE-2024-2411 MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Critical 9.8
• CVE-2024-1512 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-0441 MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pwfc-vqm5-wjvg.