Quiz And Survey Master CVE-2026-97289

Exploitation requires a WordPress site running the Quiz And Survey Master (quiz-master-next) plugin at version 11.2.6 or earlier, with a quiz or survey form/endpoint exposed. No authentication is required (PR:N), but successful attack depends on user interaction (UI:R): a victim must be induced to click a crafted link or submit attacker-controlled input that is then reflected. Impact is limited to the browser security context of the victim (S:C, C:L/I:L/A:L) rather than direct server compromise. The realistic risk is elevated when the lured victim is an authenticated administrator, since the script then runs with that user's privileges.

This is a genuine but moderate-priority web vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates a network-reachable, low-complexity, unauthenticated flaw whose main gating factor is required user interaction (UI:R) - a victim must load attacker-influenced content. The scope change (S:C) reflects the classic XSS pattern where injected script executes in the browser security context rather than the plugin's server context, and the low C/I/A impacts are consistent with reflected XSS rather than a full account takeover. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - the 7.1 is driven by unauthenticated reachability, not by evidence of real-world attacks. This is a real issue worth patching but not an emergency: it is a browser-side injection dependent on luring a user, not a server RCE or an actively exploited bug. Note that the terse Patchstack description does not name the injected parameter or sink, so the exact reflected-vs-stored nature is inferred from the unauthenticated + UI:R combination and should be confirmed against the vendor advisory.

An unauthenticated attacker crafts a URL or form submission to a WordPress site running Quiz And Survey Master <= 11.2.6 that injects malicious JavaScript into a quiz/survey field or parameter reflected without proper sanitization. When a victim (potentially a logged-in administrator) opens the crafted link, the script runs in their browser session and can steal cookies, forge admin actions, or redirect the user. No public exploit code was identified at the time of analysis.