UNKNOWN NVD

CVE-2026-14824

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribut

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

References

https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/

Published: 2026-08-04 · Source: NVD · Feed updated: 2026-08-04

This unknown severity vulnerability was published on 2026-08-04 via NVD.

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.