CVE-2026-103917

The The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 11.2.7 . The root cause is a failure to properly validate a value before executing the do_shortcode function. Because the submission nonce i...