CVE-2026-104391: WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Quiz And Survey Masterto a version that resolves this vulnerability.Fixed in 11.2.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an existing account with at least low-level privileges and must induce a user to interact with the crafted content. The attack can be performed over the network with low complexity.
What is the affected version range?
Quiz And Survey Master versions through 11.2.7 are affected. The available data does not identify a fixed version.
What is the likely impact if exploitation succeeds?
Successful exploitation allows stored cross-site scripting in the affected plugin. The provided vector indicates potential low impact to confidentiality, integrity, and availability, with the impact extending beyond the vulnerable security authority.