Quiz Survey Master CVE-2026-107862

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of submitting input to the Quiz And Survey Master plugin, plus victim user interaction (UI:R) - a target must load and interact with the page where the unsanitized input is rendered into a DOM sink. It affects Quiz And Survey Master versions from an unspecified start through 11.2.7. Limiting factors: it does not work against fully unauthenticated attackers, it depends on a victim actually visiting/interacting with the affected page, and impact is confined to the client-side browser context (Low C/I/A), not direct server compromise.

This is a moderate, not a high-priority, issue. The vendor CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable but privilege-and-interaction-gated flaw: PR:L means an authenticated low-privilege account is required, and UI:R means a victim must perform some action, both of which reduce real-world exploitability. The scope change (S:C) and only Low impacts across C/I/A are consistent with a DOM-based XSS executing in another user's browser context rather than compromising the server. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no signal of active or automatable exploitation. The signals are internally consistent (authenticated + user-interaction XSS with limited impact), so there is no network-vs-local or EPSS-vs-KEV conflict to flag - the main caveat is simply that exploitation probability data (EPSS) is absent, so prioritization rests on the CVSS vector alone. Net: patch in normal cycle for affected WordPress sites; it is a genuine but limited client-side flaw, not a critical server-compromise bug.

An authenticated low-privilege user (e.g., a contributor or a user able to submit quiz/survey data) injects a crafted payload that is reflected into the DOM without proper neutralization. When an administrator or another victim loads the affected page and interacts with it, the script executes in their browser session, enabling session actions in their context. No public exploit code was identified at time of analysis.