What is the CVSS score of CVE-2026-40787?

CVE-2026-40787 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Quiz And Survey Master are affected by CVE-2026-40787?

The Quiz And Survey Master WordPress plugin (up to version 11.0.0) contains a cross-site scripting (XSS) vulnerability exploitable by unauthenticated attackers, exposing all WordPress site visitors…

How to fix or mitigate CVE-2026-40787?

24 hours: Inventory all WordPress installations using Quiz And Survey Master and identify instances running version 11.0.0 or earlier. 7 days: Disable or remove the plugin if operationally feasible; if required for business function, implement Web Application Firewall rules blocking JavaScript payloads in survey form submissions and restrict plugin access to authenticated users only. 30 days: Monitor Patchstack and WordPress.org plugin repository for patched version (11.0.1 or later); deploy patch immediately upon vendor release and verify functionality across all instances.

Quiz And Survey Master CVE-2026-40787

EUVD-2026-36990 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-c638-vf62-q5jh

WordPress XSS Quiz And Survey Master Wordpress Plugin Expresstech

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected/stored XSS reachable over the network requires victim click (UI:R); script runs in victim origin causing scope change with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:07 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

AnalysisAI

Stored or reflected cross-site scripting in the Quiz And Survey Master WordPress plugin (versions up to and including 11.0.0) allows remote unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser after a single user interaction. Patchstack reports the issue under EUVD-2026-36990 with a CVSS 3.1 base score of 7.1 reflecting scope change and partial impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Quiz And Survey Master (slug quiz-master-next, vendor ExpressTech) is a widely deployed WordPress plugin used to build quizzes, surveys, and lead-capture forms. The flaw is classified as CWE-79 - Improper Neutralization of Input During Web Page Generation - meaning attacker-controlled input is rendered back into HTML/JS contexts without proper output encoding or input sanitization. The affected CPE cpe:2.3:a:expresstech:quiz_and_survey_master covers all builds through 11.0.0, indicating the unsafe code path is present across the plugin's current major release line and is reachable without authentication, suggesting a public-facing quiz/survey rendering or submission endpoint as the injection sink.

RemediationAI

No vendor-released patch version was provided in the input data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-0-0-cross-site-scripting-xss-vulnerability) and upgrade Quiz And Survey Master to the first release above 11.0.0 once the maintainer publishes a fix. Until a patched version is confirmed, compensating controls include deactivating the plugin on sites that do not actively use quiz or survey functionality (trade-off: quizzes/surveys become unavailable), placing the WordPress admin area behind IP allowlisting or SSO so a stolen session is harder to abuse (trade-off: friction for remote admins), and deploying a WAF rule or Patchstack vPatch that blocks payloads containing script tags or javascript: URIs against quiz/survey submission and rendering endpoints (trade-off: may break legitimate rich-text quiz content). Administrators should also be trained to avoid clicking unsolicited quiz preview or survey links while logged in.