Cross-Site Scripting Vulnerability in Quiz and Survey Master Plugin by WordPress
CVE-2026-14824
Currently unrated
What is CVE-2026-14824?
The Quiz and Survey Master plugin for WordPress, prior to version 11.2.2, is susceptible to a cross-site scripting (XSS) vulnerability. This issue arises due to insufficient escaping of question settings before rendering them in unquoted HTML attributes. As a result, users with contributor-level access or higher can inject arbitrary JavaScript. This injected script executes in the browsers of users who view the affected quiz, leading to potential exploits and data compromise.
Affected Version(s)
Quiz and Survey Master (QSM) 0 < 11.2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.