Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-54699
CVE-2025-54699:
WordPress vulnerability analysis and mitigation
Overview
The Masteriyo - LMS plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-54699) affecting versions up to and including 1.18.3. The vulnerability was discovered by Denver Jackson and was publicly disclosed on July 30, 2025. This security issue affects the WordPress plugin's input handling mechanisms (Rapid7, Patchstack).
Technical details
The vulnerability stems from insufficient input sanitization and output escaping in the Masteriyo - LMS plugin. It has been assigned a CVSS score of 6.4-6.5 (Medium severity). The technical assessment indicates that the vulnerability allows for the injection of arbitrary web scripts that execute when users access affected pages (Rapid7, Patchstack).
Impact
The vulnerability enables authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts can potentially be used to insert redirects, advertisements, and other HTML payloads that execute when visitors access the affected pages. The impact is classified under the OWASP Top 10 category A3: Injection (Patchstack).
Mitigation and workarounds
The vulnerability has been patched in version 1.18.4 of the Masteriyo - LMS plugin. Site administrators are advised to update to version 1.18.4 or later to remove the vulnerability. For additional protection, Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management