Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Arbitrary Shortcode Execution via Quiz Answers, Contact Fields and Comments
- ID
- WPSEC-2026-2891
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- all versions before 11.3.1
- Remediation
- Update to 11.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz and Survey Master (QSM) on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to arbitrary shortcode execution via quiz answers, contact fields, question comments, quiz comments and Polar slider answers in all versions up to, and including, 11.3.0. This is due to the plugin sanitizing submitted values only with strip_shortcodes(), which leaves the escaped [[tag]] form intact so that it becomes a live shortcode when the results page runs do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example [qsm_result] to disclose other users' quiz results. Logged-in users could do the same through their own profile names in the %FULL_NAME% and %USER_NAME% template variables.
References
- https://wpsec.com/vuln/WPSEC-2026-2891/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS