Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting via 'qsm_hidden_questions' Parameter
- ID
- WPSEC-2026-0297
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- from 8.1.9 before 11.2.7
- Remediation
- Update to 11.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-96558, on 2026-10-09.
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qsm_hidden_questions' parameter in versions 8.1.9 up to, and including, 11.2.6. This is due to insufficient input sanitization and output escaping: the value is sanitized before it is JSON-decoded, so unicode-escaped markup is turned back into raw HTML, and the submission data is then stored in the Audit Trail and inserted into the page as HTML when its details are viewed. This makes it possible for unauthenticated attackers submitting a quiz to inject arbitrary web scripts that execute when a user with access to the plugin's Tools page opens the entry in the Audit Trail. The submission is recorded in the Audit Trail when its result fails to save, a condition the attacker can cause.
References
- https://wpsec.com/vuln/WPSEC-2026-0297/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.2.7/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS