4.8
Moyenne
CVE-2026-14824 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before…
Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Quiz and Survey Master (QSM) 11.2 | premières → < 11.2.2 | 11.2.2 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Quiz and Survey Master (QSM)
Les 14 CVE de Quiz and Survey Master (QSM) →
CVE-2026-79615
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question…
2.7
Faible
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the…
2.7
Faible
CVE-2026-14825
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before…
2.7
Faible
CVE-2026-14821
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting…
2.7
Faible