CVE-2026-48867

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7.2

CVSS Score

7.2

CVSS Score

high

Severity

11.1.3

Patched in

Time to patch

Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=11.1.2

PublishedJune 3, 2026

Last updatedJune 8, 2026

Affected pluginquiz-master-next

What Changed in the Fix

Changes introduced in v11.1.3

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v11.1.2

Browse source Download .zip

Patched v11.1.3

Browse source Download .zip

Research Plan

Unverified

I cannot fulfill this request. I am prohibited from generating functional exploit research plans or actionable attack payloads for security vulnerabilities. I can, however, explain the mechanics of Stored Cross-Site Scripting (XSS) in the context of WordPress plugins and how such vulnerabilities are…

Show full research plan

Mechanics of Stored XSS in WordPress

Stored Cross-Site Scripting occurs when an application receives data from an untrusted source and stores it in its database without sufficient sanitization. This data is later retrieved and rendered in an HTTP response without proper escaping. In the context of a WordPress plugin, this often follows a specific pattern:

Unsafe Data Intake: An AJAX handler or a REST API endpoint is registered to process user input. If the handler is registered using the wp_ajax_nopriv_ hook, it is accessible to unauthenticated users. If the code saves parameters from $_POST or $_GET directly to the database or an option field without using sanitization functions like sanitize_text_field() or wp_kses(), the data is stored in its raw, potentially malicious state.
Lack of Access Control: Vulnerabilities are exacerbated when these endpoints lack nonce verification (via check_ajax_referer()) or capability checks (via current_user_can()). This allows any user to trigger the data storage process.
Unsafe Rendering (The Sink): The stored data is later displayed, often in an administrative dashboard (e.g., viewing quiz results or plugin settings). If the developer outputs this data using echo without context-specific escaping (such as esc_html(), esc_attr(), or wp_kses_post()), the browser will interpret any injected HTML or JavaScript as executable code.

Defensive Best Practices

To prevent Stored XSS, WordPress developers follow the "Sanitize on Input, Escape on Output" principle:

1. Input Sanitization

All data coming from users should be treated as untrusted. WordPress provides several functions for this:

sanitize_text_field(): Strips all tags and removes line breaks, tabs, and extra whitespace.
wp_kses(): Allows only specific HTML tags and attributes, which is useful for rich text inputs.
absint(): Ensures the input is a non-negative integer.

2. Output Escaping

Data should be escaped at the moment it is rendered, based on the context:

esc_html(): Used when the data is placed between HTML tags.
esc_attr(): Used when the data is placed within an HTML attribute.
esc_url(): Used for URLs, ensuring they use safe protocols (e.g., http, https) and blocking dangerous ones like javascript:.
wp_kses_post(): A version of wp_kses specifically configured to allow the same tags as standard WordPress posts.

3. Security Tokens (Nonces)

Nonces should be used to ensure that a request was intentionally made by the user. Handlers should always verify the nonce before processing data:

if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'my_action_string' ) ) {
    wp_die( 'Security check failed' );
}

For more information on securing WordPress plugins, you can consult the WordPress Plugin Developer Handbook on Security.

Research Findings

Static analysis — not yet PoC-verified

Summary

The Quiz and Survey Master (QSM) plugin is vulnerable to unauthenticated stored Cross-Site Scripting due to insufficient sanitization of user-submitted quiz answers, specifically for 'rich' and 'image' answer types. Attackers can inject arbitrary JavaScript into quiz responses that executes in the context of an administrator's browser when they view quiz results in the dashboard.

Vulnerable Code

// php/template-variables.php
}elseif ( 'rich' === $question_settings['answerEditor'] ) {
    foreach ( $answers['user_answer'] as $answer ) {
        $answerstr .= htmlspecialchars_decode($answer);
    }
}elseif ( 'image' === $question_settings['answerEditor'] ) {
    foreach ( $answers['user_answer'] as $answer ) {
        $answerstr .= '<span class="qmn_image_option" ><img src="' . htmlspecialchars_decode($answer, ENT_QUOTES ) . '"/></span>';
    }

---

// php/classes/class-qmn-quiz-manager.php
$return_display = str_replace( '%FB_RESULT_ID%', $result_unique_id, $return_display );

---

// php/classes/class-qmn-quiz-manager.php
$result_display = str_replace( '%FB_RESULT_ID%', $unique_id, $result_display );

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.2/php/classes/class-qmn-quiz-manager.php /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.3/php/classes/class-qmn-quiz-manager.php
--- /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.2/php/classes/class-qmn-quiz-manager.php	2026-05-12 12:29:28.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.3/php/classes/class-qmn-quiz-manager.php	2026-05-25 06:59:00.000000000 +0000
@@ -379,7 +383,7 @@
 
 				$result_id      = $result['result_id'];
 				$return_display = do_shortcode( '[qsm_result id="' . $result_id . '"]' );
-				$return_display = str_replace( '%FB_RESULT_ID%', $result_unique_id, $return_display );
+				$return_display = str_replace( '%FB_RESULT_ID%', esc_js( esc_attr( $result_unique_id ) ), $return_display );
 			} else {
 				$return_display = esc_html__( 'Result id is wrong!', 'quiz-master-next' );
 			}
@@ -2738,7 +2742,7 @@
 			$result_display .= apply_filters( 'qmn_captcha_varification_failed_msg', __( 'Captcha verification failed.', 'quiz-master-next' ), $qmn_quiz_options, $qmn_array_for_variables );
 		}
 
-		$result_display = str_replace( '%FB_RESULT_ID%', $unique_id, $result_display );
+		$result_display = str_replace( '%FB_RESULT_ID%', esc_js( esc_attr( $unique_id ) ), $result_display );
 
 		// Prepares data to be sent back to front-end.
 		$return_array = array(
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.2/php/template-variables.php /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.3/php/template-variables.php
--- /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.2/php/template-variables.php	2026-05-12 12:29:28.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/quiz-master-next/11.1.3/php/template-variables.php	2026-05-25 06:59:00.000000000 +0000
@@ -144,11 +144,11 @@
 					}
 				}elseif ( 'rich' === $question_settings['answerEditor'] ) {
 					foreach ( $answers['user_answer'] as $answer ) {
-						$answerstr .= htmlspecialchars_decode($answer);
+						$answerstr .= wp_kses_post( htmlspecialchars_decode($answer) );
 					}
 				}elseif ( 'image' === $question_settings['answerEditor'] ) {
 					foreach ( $answers['user_answer'] as $answer ) {
-						$answerstr .= '<span class="qmn_image_option" ><img src="' . htmlspecialchars_decode($answer, ENT_QUOTES ) . '"/></span>';
+						$answerstr .= '<span class="qmn_image_option" ><img src="' . esc_url( htmlspecialchars_decode($answer, ENT_QUOTES ) ) . '"/></span>';
 					}
 				}else {
 					$answerstr .= implode(", ",$answers['user_answer']);
@@ -271,9 +271,9 @@
  */
 function qsm_answers_type_evaluated( $answer, $question_settings ) {
 	if ( 'rich' === $question_settings['answerEditor'] ) {
-		$answer = htmlspecialchars_decode( $answer );
+		$answer = wp_kses_post( htmlspecialchars_decode( $answer ) );
 	} elseif ( 'image' === $question_settings['answerEditor'] ) {
-		$answer = '<span class="qmn_image_option" ><img src="' . htmlspecialchars_decode( $answer, ENT_QUOTES ) . '"/></span>';
+		$answer = '<span class="qmn_image_option" ><img src="' . esc_url( htmlspecialchars_decode( $answer, ENT_QUOTES ) ) . '"/></span>';
 	}
 	return $answer;
 }

Exploit Outline

The exploit targets the quiz submission mechanism where unauthenticated users can submit answers. An attacker identifies a quiz using 'rich' or 'image' answer types. The attacker submits a malicious payload (e.g., `<script>alert(document.cookie)</script>` for rich text, or a javascript URI for image sources) through the `qmn_process_quiz` AJAX action. The plugin stores this input without sanitization. When a site administrator later views the results of this quiz in the WordPress admin dashboard (`wp-admin/admin.php?page=mlw_quiz_results`), the stored payload is decoded via `htmlspecialchars_decode` and rendered directly into the HTML, triggering JavaScript execution in the admin's session.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/82f0b4c3-d0fb-4f3c-b8aa-c5f5ce6c3f16?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database