CVE-2026-14824

The Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape a question setting before it is outputted into an unquoted HTML attribute . This allows users with contributor-lev...