CVE-2026-14824

Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

Affected

Quiz and Survey Master (QSM)

CVSS v3.1 CNA

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-08-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/

References

• CVE Record
• NVD entry