CVE-2026-19712: The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in

The Masteriyo LMS WordPress plugin before version 2.3.3 has a stored cross-site scripting (XSS, an attack where malicious code is saved and runs when others view a page) vulnerability. Instructors can store unfiltered HTML in a quiz field, which then executes in visitors' browsers when they view that page, potentially compromising accounts including administrators. Single-site WordPress installations with default settings are affected, but multisite installations and those with DISALLOW_UNFILTERED_HTML enabled are protected.