{"id":"CVE-2026-14824","aliases":["EUVD-2026-52585","GHSA-6f4p-h5wh-rgq9"],"status":"published","title":"Quiz And Survey Master \u003c 11.2.2 - Contributor+ Stored XSS via Polar Question","description":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00242,"percentile":0.15456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-08-04T06:00:09Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"unknown","product":"quiz and survey master (qsm)"}],"references":[{"url":"https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14824"},{"url":"https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254"},{"url":"https://github.com/advisories/GHSA-6f4p-h5wh-rgq9"}],"sources":{"cve":[{"id":"CVE-2026-14824","title":"Quiz And Survey Master \u003c 11.2.2 - Contributor+ Stored XSS via Polar Question","description":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.","status":"published","published":"2026-08-04T06:00:09.863Z","modified":"2026-08-04T17:32:29.922Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-52585","description":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.","status":"published","published":"2026-08-04T06:00:09Z","modified":"2026-08-04T17:32:29Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:22.965583Z"}],"ghsa":[{"id":"GHSA-6f4p-h5wh-rgq9","title":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a...","description":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.","status":"published","published":"2026-08-04T09:31:34Z","modified":"2026-08-04T18:31:25Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:05.423688Z"}],"nvd":[{"id":"CVE-2026-14824","description":"The Quiz and Survey Master (QSM)  WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.","status":"published","published":"2026-08-04T07:16:28.713Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:34.643497Z"}]}}