Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T05:16:45.643Z",
  "pubdate": "2026-08-16T05:16:45.643Z",
  "executiveSummary": "The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 11.2.1. This security flaw stems from inadequate input sanitization and output escaping mechanisms applied to user-supplied data handled by the application.\nThe vulnerability allows authenticated attackers possessing contributor-level access privileges or higher to inject arbitrary web scripts or malicious HTML payloads into the application. Once successfully stored, these injected scripts execute within the context of a victim's browser session whenever they access the affected administrative or frontend pages containing the rendered payload.\nThe risk implications include potential session hijacking, unauthorized actions performed on behalf of other users, and defacement of affected pages. Exploitation requires authenticated access with specific privilege levels, limiting unauthenticated remote attacks but posing a significant threat from malicious internal actors or compromised low-privileged accounts.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization and output escaping of data passed through the vulnerable 'question_title' parameter within the Quiz and Survey Master plugin. When the application receives input via this parameter, it fails to properly neutralize executable script content before storing the data in the underlying database.\nThe vulnerable component is the parameter handling mechanism for question titles within the plugin's data processing routines. The affected versions include all releases up to and including version 11.2.1. The vulnerability is exploitable by authenticated users who possess contributor-level access or higher, meaning an attacker must first obtain valid credentials and appropriate permissions to interact with the quiz creation or editing functionalities.\nThe exploitation flow proceeds as follows: First, an authenticated attacker with contributor privileges navigates to the quiz creation or editing interface. Second, the attacker crafts a malicious payload containing arbitrary JavaScript or HTML tags and injects it into the 'question_title' parameter field. Third, upon submitting the form, the application processes the input and stores the unsanitized payload directly into the database without performing robust validation or context-aware encoding. Fourth, when a victim—such as an administrator or another user—accesses the page where the question title is rendered, the application outputs the raw, unescaped payload into the Document Object Model (DOM). Finally, the victim's browser interprets the injected script as legitimate code and executes it within the security context of the victim's active session, potentially leading to unauthorized operations or data exposure."
}