WordPress Plugin Vulnerabilities

Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

Description

The plugin does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

Proof of Concept

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 11.2.2

References

CVE
CVE-2026-14824

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
ba8f3e6b-c2c9-4e72-825c-b98b4330c254

Timeline

Publicly Published
2026-07-27 (about 8 days ago)
Added
2026-07-27 (about 7 days ago)
Last Updated
2026-07-27 (about 7 days ago)

Other

Published
Title
Published
2025-11-07
Title
HTML Forms < 1.5.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2026-06-25
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2023-11-27
Title
WP Shortcodes Plugin — Shortcodes Ultimate < 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-10
Title
Coon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-03-04
Title
Easy!Appointments < 1.3.2 - Contributor+ Stored Cross-Site Scripting