CVE-2026-14824 — Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users…
Published: 2026-08-04 · CVSS: 4.8 · CVSS 3.1
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7