Quiz and Survey Master CVE-2026-96558

Exploitation requires the Quiz and Survey Master (QSM) plugin (≤11.2.6) with a publicly accessible quiz submission form. The attacker must inject script via the 'qsm_hidden_questions' parameter AND deliberately cause the mlw_results database INSERT to fail by submitting an over-length or duplicate 'qsm_unique_key' value - this is the mandatory trigger that routes the payload into the unescaped audit-trail write (wp_mlw_qm_audit_trail.form_data). Payload execution is deferred and requires a victim (typically an administrator reviewing audit/results data, or a user) to subsequently load the page rendering the stored data. Limiting factors: the attack is not a single clean request - it depends on reliably forcing the INSERT failure branch, and impact is realized only when a privileged user views the injected content, so success hinges on that viewing occurring.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) correctly captures an unauthenticated, network-reachable stored XSS with scope change - the injected script executes in a different security context (admin/other users viewing the audit trail or injected page) than the attacker's. However, the description reveals a meaningful real-world constraint the raw vector obscures: exploitation only reaches the vulnerable audit-trail branch after the attacker forces the mlw_results INSERT to fail via an over-length or duplicate qsm_unique_key, so the 'AC:L' rating is arguably optimistic. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization; the finding originates solely from Wordfence threat-intel research. Net: a legitimate stored XSS worth patching promptly on exposed WordPress sites, but currently 'no public exploit identified at time of analysis' and gated behind a specific trigger, placing it below internet-wide mass-exploitation threats.

An unauthenticated attacker submits a quiz response containing a malicious script in the qsm_hidden_questions parameter while deliberately supplying an over-length or already-used qsm_unique_key so the normal mlw_results INSERT fails. This diverts execution into the audit-trail fallback, which writes the unescaped payload into wp_mlw_qm_audit_trail.form_data, and the script later executes in the browser of an administrator reviewing results or any user who loads the injected page. No public exploit code was identified in the provided data.