CVE-2026-107862: WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/quiz-and-survey-masterto a version that resolves this vulnerability.Fixed in 11.2.8
Event History
Frequently Asked Questions
Which deployments are affected?
Quiz And Survey Master versions through 11.2.7 are affected. The available data does not identify a safe fixed version.
What access does an attacker need to exploit this issue?
The severity vector indicates an attacker needs network access, low privileges, and user interaction. Exploitation is rated low complexity.
What is the potential impact of successful exploitation?
Successful exploitation may allow limited disclosure, modification, and disruption, with impact extending beyond the vulnerable component's security authority.