EUVD-2026-23373
GHSA-7rv8-2hr2-39f9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire results page output (including user answers), causing any injected shortcodes to be executed. This makes it possible for unauthenticated attackers to inject arbitrary WordPress shortcodes such as [qsm_result id=X] to access other users' quiz submissions without authorization, as the qsm_result shortcode lacks any authorization checks.
AnalysisAI
Quiz And Survey Master plugin for WordPress (versions up to 11.1.0) allows unauthenticated attackers to execute arbitrary WordPress shortcodes via user-submitted quiz answers. User inputs are sanitized with sanitize_text_field() and htmlspecialchars(), which strip HTML tags but fail to remove shortcode brackets [ and ]. When quiz results are displayed, the plugin executes do_shortcode() on the entire results page including user answers, enabling injection of shortcodes like [qsm_result id=X] to access unauthorized quiz submissions. This is a direct information disclosure vulnerability masked by RCE tagging; confirmed CVSS 5.3 (Integrity impact) indicates data tampering/unauthorized access rather than code execution.
Technical ContextAI
The vulnerability stems from improper use of WordPress's output encoding and shortcode processing functions. WordPress shortcodes are delimited by square brackets [shortcode] and are processed server-side by the do_shortcode() function, which recursively evaluates and replaces shortcode syntax with dynamic content. The Quiz And Survey Master plugin (identified via CPE as expresstech's quiz_and_survey_master_qsm) sanitizes user quiz answers using sanitize_text_field() and htmlspecialchars(), both of which are designed to prevent HTML/JavaScript injection, not shortcode injection. The sanitize_text_field() function removes HTML tags but explicitly preserves square brackets per WordPress documentation. When results are rendered, do_shortcode() is called on the entire results page output (including stored user answers from the database), causing injected shortcodes to be parsed and executed with the same permissions as the quiz plugin. The qsm_result shortcode, which displays quiz results indexed by ID, lacks authorization checks (nonce validation or capability checks), allowing unauthenticated access to arbitrary quiz submissions. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component / 'Injection'), as user input is not neutralized before being processed by a downstream dangerous function (do_shortcode).
RemediationAI
Update Quiz And Survey Master plugin to a patched version released after 11.1.0. Immediate remediation requires applying a patch that neutralizes shortcode brackets in user-submitted answers before they are stored or processed by do_shortcode()-either by escaping [ and ] characters (e.g., using wp_kses_post() with restricted allowed HTML), stripping them entirely, or by calling do_shortcode() only on plugin-controlled template output, not on user data. The WordPress SVN repository reference indicates patches may already be committed; check the plugin's WordPress.org page or GitHub repository (if public) for the latest stable release, and upgrade immediately. As a temporary workaround until patching is possible, disable the Quiz And Survey Master plugin entirely if it is not actively in use, or restrict quiz access to authenticated users only via the WordPress admin settings (reducing attack surface from unauthenticated to authenticated attackers). If the plugin is actively used, implement a Web Application Firewall (WAF) rule to block HTTP requests containing shortcode syntax (regex pattern \[.*?\]) in quiz submission POST parameters; note that this may block legitimate use cases where users intentionally enter square-bracket text. Additionally, audit quiz results and submissions from the past several months for anomalous shortcode injections (check the wp_posts or plugin's custom tables for entries containing [ characters) to detect if exploitation has already occurred. Add capability checks and nonce verification to any shortcode that accesses or displays user data (specific to the qsm_result shortcode), ensuring only authorized users can view quiz submissions.
The Quiz and Survey Master (QSM) WordPress plugin versions up to 10.3.5 contains a SQL injection vulnerability in the 'm
Authorization bypass in Quiz and Survey Master WordPress plugin for versions up to 11.1.4 allows authenticated attackers
Authorization bypass in the Quiz and Survey Master (QSM) WordPress plugin (all versions through 11.1.4) allows authentic
Share
External POC / Exploit Code
Leaving vuln.today