# Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'result_id' and 'qsm_unique_key' Parameters

- **ID:** WPSEC-2026-0466
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** from 11.2.6 before 11.2.8
- **Fixed in:** 11.2.8 (Update to 11.2.8 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-10-05
- **Published:** 2026-10-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0466/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'qsm_unique_key' and 'result_id' parameters in versions 11.2.6 to 11.2.7. This is due to the plugin storing a visitor-supplied 'qsm_unique_key' as the result's unique ID and later concatenating the 'result_id' value into a shortcode string passed to do_shortcode() without removing shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-0466/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.2.8/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0466/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.