What is the CVSS score of CVE-2026-48867?

CVE-2026-48867 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Quiz And Survey Master are affected by CVE-2026-48867?

The Quiz And Survey Master WordPress plugin (versions through 11.1.2) contains an unauthenticated cross-site scripting vulnerability enabling attackers to inject malicious JavaScript into user…

How to fix or mitigate CVE-2026-48867?

24 hours: Audit all WordPress instances to identify installations and versions of Quiz And Survey Master plugin. 7 days: Deactivate and remove the plugin across all affected sites, or implement WAF rules blocking script injection patterns if removal creates operational disruption; apply CSP headers to restrict inline script execution. 30 days: Monitor the plugin repository and vendor security advisories for a patched version; establish automated testing and deployment of patches within 48 hours of release.

Quiz And Survey Master CVE-2026-48867

EUVD-2026-36846 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-5244-97w9-328g

WordPress XSS Quiz And Survey Master Wordpress Plugin Expresstech

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS requiring victim interaction; scope changes into the victim's authenticated session, with limited C/I/A impact typical of reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:50 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in the Quiz And Survey Master WordPress plugin (versions through 11.1.2) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser after user interaction. Exploitation is reflected in the CVSS 7.1 (High) score with a scope change, meaning injected script can impact resources beyond the vulnerable component. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Quiz And Survey Master (slug: quiz-master-next), maintained by ExpressTech, is a widely deployed WordPress plugin used to build quizzes, surveys, and forms on WordPress sites. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating user-controllable input is rendered into HTML or JavaScript context without sufficient encoding or sanitization. Because the CVSS vector specifies S:C (scope changed), the injected payload likely executes in a security context that crosses a trust boundary - typical for WordPress XSS where unauthenticated input ends up rendered inside an admin or other user's authenticated session.

RemediationAI

No vendor-released patched version is independently confirmed in the supplied intelligence; administrators should upgrade Quiz And Survey Master to any release later than 11.1.2 as published on the WordPress plugin repository and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-1-2-cross-site-scripting-xss-vulnerability for fixed-version details. Until upgrade is possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing script tags or event-handler payloads to quiz/survey endpoints provided by the plugin - accepting the trade-off of potential false positives on legitimate rich-text submissions. As additional compensating controls, restrict access to plugin endpoints to authenticated users via .htaccess or server config (side effect: breaks public quiz/survey functionality, which may defeat the plugin's purpose), enforce a strict Content-Security-Policy that disallows inline scripts on pages rendering plugin output (side effect: may break legitimate plugin JavaScript and require tuning), and instruct administrators to avoid clicking unsolicited links to their own site while the issue is unpatched.