CVE-2026-14824 — Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

CVE-2026-14824

Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question PUBLISHED

Description (CNA)

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

Affected (CNA)

Vendor / product	Versions
Unknown / Quiz and Survey Master (QSM)	affected 0 before 11.2.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.