Authorization Bypass in Quiz and Survey Master Plugin for WordPress

CVE-2026-9233

What is CVE-2026-9233?

The Quiz and Survey Master plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access and above to bypass authorization controls. This flaw enables them to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table. The vulnerability arises because the plugin fails to adequately verify user permissions, potentially allowing the insertion of unsanitized HTML content, including arbitrary script tags, posing a significant security risk.

References