CVE-2026-14824

4.8 MEDIUM

Published 2026-08-04 · Updated 2026-08-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

All references

https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.