Quiz Master Next EUVD-2026-94252

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of submitting content into a Quiz And Survey Master field that the plugin stores and later renders. The payload only triggers when a victim user views the stored content (UI:R), so impact depends on a higher-privileged user - typically an administrator reviewing submissions - opening the affected page. Limiting factors: no anonymous/unauthenticated path, dependence on victim interaction, and reliance on the site permitting the relevant low-privilege role to submit quiz/survey data; the scope change means the practical impact scales with the privilege of the viewing victim.

This is a medium-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C) reported by Patchstack in the Quiz And Survey Master WordPress plugin through 11.2.7. The network attack vector and low complexity are offset by two real limiting factors encoded in the vector: PR:L means the attacker must already hold a low-privilege authenticated account, and UI:R means a victim must view the injected content for the payload to fire. The scope change (S:C) is the meaningful aggravator - a low-privileged contributor's stored payload executes in the browser context of higher-privileged users (e.g., administrators) who review quiz/survey submissions or content, enabling session or account takeover beyond the attacker's own privilege level. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from signals; this appears to be a routine Patchstack-catalogued plugin XSS rather than a flagged priority. There is no conflict between the CVSS vector and the description - both consistently point to authenticated, interaction-dependent stored XSS. Treat as a patch-in-normal-cycle item unless the specific WordPress site grants untrusted users content-submission privileges.

A user with a low-privilege authenticated role (e.g., a contributor or a quiz/survey submitter) injects a malicious script into a Quiz And Survey Master field that is stored without proper output neutralization. When an administrator or other higher-privileged user later views that content in wp-admin, the script executes in their session, enabling cookie/session theft or admin actions. No public exploit was identified at time of analysis, so a working payload would need to be developed.