medium4.8
CVE-2026-14824
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribut…
Impact
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Affected products
| Product | Affected versions |
|---|---|
| Quiz And Survey Master (QSM) WordPress Plugin | before 11.2.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.