What is the CVSS score of CVE-2026-14821?

CVE-2026-14821 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14821?

Yes, a public proof-of-concept exploit is available for CVE-2026-14821. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14821?

Yes, a patch is available for CVE-2026-14821. Update the affected software to the latest version immediately.

Quiz And Survey Master Qsm CVE-2026-14821

EUVD-2026-49700 LOW

Missing Authorization (CWE-862)

2026-07-28 WPScan

GHSA-v9qq-hpjj-75m3

WordPress Authentication Bypass Quiz And Survey Master Qsm Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 14:42 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

2.7 (LOW)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

AnalysisAI

The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.