Arbitrary Shortcode Execution Vulnerability in Quiz And Survey Master Plugin by WordPress

CVE-2026-5797

What is CVE-2026-5797?

The Quiz And Survey Master plugin for WordPress has a vulnerability that allows for Arbitrary Shortcode Execution due to inadequate input sanitization. Users' submitted quiz answers are not properly sanitized before being processed by the plugin, enabling attackers to inject malicious shortcodes. When the quiz results are displayed, the plugin executes these injected shortcodes without appropriate authorization checks, potentially exposing sensitive user information. This vulnerability affects versions up to and including 11.1.0, making it critical for site administrators to update to secure versions to prevent exploitation.

References