What is the CVSS score of CVE-2026-9233?

CVE-2026-9233 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Quiz and Survey Master CVE-2026-9233

EUVD-2026-39952 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-jrf7-2c28-2hc3

WordPress Authentication Bypass Quiz And Survey Master Qsm Easy Quiz And Survey Maker Wordpress Plugin Expresstech

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS consequence introduces scope change (S:C) and confidentiality impact (C:L) when admin views injected template, requiring UI:R.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:51 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.

AnalysisAI

Authorization bypass in the Quiz and Survey Master (QSM) WordPress plugin (all versions through 11.1.4) allows authenticated contributors to create, modify, and delete quiz output templates in the mlw_quiz_output_templates database table without proper capability checks. Because template content is stored without sanitization, this grants contributor-level users the practical ability to inject arbitrary script tags into templates viewable by higher-privileged users such as administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low privilege requirement makes this accessible to any registered contributor on affected WordPress installations.

Technical ContextAI

The vulnerability exists in the QSM plugin by expresstech (CPE: cpe:2.3:a:expresstech:quiz_and_survey_master_(qsm)_-_easy_quiz_and_survey_maker:*:*:*:*:*:*:*:*), a WordPress plugin providing quiz and survey creation functionality. The root cause is CWE-862 (Missing Authorization): the plugin's admin functions - specifically in php/admin/functions.php at lines 1557, 1563, and 1638, and mlw_quizmaster2.php at line 931 - handle quiz output template CRUD operations without verifying that the requesting user holds sufficient WordPress capabilities (e.g., manage_options or an equivalent role check). The secondary impact arises from a lack of HTML sanitization on stored template data, meaning script tags submitted by a low-privileged contributor are persisted as-is in the mlw_quiz_output_templates database table and rendered when an authorized user later views the template, creating a stored cross-site scripting (XSS) vector.

RemediationAI

An upstream fix is available as changeset 3570062 in the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3570062%40quiz-master-next&new=3570062%40quiz-master-next); however, the specific patched release version is not independently confirmed from the available data - administrators should update to the latest available version of QSM beyond 11.1.4 via the WordPress plugin dashboard and verify the installed version exceeds the vulnerable range. As an immediate compensating control, site administrators should audit contributor-level user accounts and restrict new user registration if not operationally required, since closing open registration eliminates the lowest-friction attack path. Additionally, a Web Application Firewall rule blocking script-tag content in POST parameters targeting the QSM template endpoints can reduce injection risk without disabling the plugin entirely, though this may cause false positives on legitimate HTML template editing. Review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/38db911b-cad5-4c8c-b0a4-70dc543b4591 for updated patch confirmation.