CVE-2026-103917: Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. The nonce required by the affected submission flow can be obtained through the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, so it does not provide meaningful authorization protection.

Q: What does an attacker need to do to exploit it?

An attacker needs to submit a crafted qsm_unique_key parameter through the affected action after obtaining the publicly available nonce. No authenticated WordPress account is required.

Q: Are installations running the default public-facing configuration exposed?

The available data identifies a public unauthenticated AJAX endpoint that issues the required nonce. This indicates that the nonce mechanism itself does not limit exposure to logged-in users.

Published Nov 7, 2026

Updated

The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wpajaxnoprivqsmcreatequiznonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and imposes no meaningful obstacle to exploitation.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:39 AM

Data Sourced

via MITRE·06:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. The nonce required by the affected submission flow can be obtained through the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, so it does not provide meaningful authorization protection.

What does an attacker need to do to exploit it?

An attacker needs to submit a crafted qsm_unique_key parameter through the affected action after obtaining the publicly available nonce. No authenticated WordPress account is required.

Are installations running the default public-facing configuration exposed?

The available data identifies a public unauthenticated AJAX endpoint that issues the required nonce. This indicates that the nonce mechanism itself does not limit exposure to logged-in users.

CVE-2026-103917: Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

Are installations running the default public-facing configuration exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

Are installations running the default public-facing configuration exposed?