EUVD-2026-52585
GHSA-6f4p-h5wh-rgq9
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Contributor is a low-privilege WordPress role (PR:L not PR:H); all other metrics align with stored XSS with scope change to visitor browsers.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
AnalysisAI
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) rooted in insufficient output encoding. The affected component is the quiz question settings rendering layer of the QSM WordPress plugin (CPE: cpe:2.3:a:unknown:quiz_and_survey_master_(qsm):*:*:*:*:*:*:*:*), which writes user-supplied question configuration values directly into an HTML attribute without quoting or escaping. Unquoted HTML attributes allow injection of additional attributes or event handlers (e.g., onmouseover=alert(1)) without any encoding bypass needed - the attacker simply closes the attribute context with a space. This is a server-side rendering failure in a PHP-based WordPress plugin, meaning the malicious payload is stored in the WordPress database and rendered to every subsequent visitor, making this persistent (stored) XSS rather than reflected. The scope change (S:C in CVSS) reflects that the victim population extends beyond the authenticated contributor - any anonymous or authenticated visitor viewing the quiz is affected.
RemediationAI
The primary fix is upgrading the Quiz and Survey Master plugin to version 11.2.2 or later, available via the WordPress plugin repository or through the WordPress admin dashboard. The vendor-released patch addresses the missing output escaping of question settings before rendering into HTML attributes. As a compensating control if immediate upgrade is not possible, restrict contributor-level registration or audit existing contributor accounts to ensure only trusted users hold that role, since the attack requires at minimum contributor access to create or edit quiz questions. Alternatively, a WAF rule targeting unquoted attribute injection patterns in POST requests to quiz-editing endpoints can reduce exploitation risk, though with potential false positives for legitimate rich-content input. The WPScan advisory at https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/ should be consulted for any additional vendor guidance.
More in Quiz And Survey Master Qsm
View allUsername enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows un
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answ
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level per
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today