{
 "id": "WPSEC-2026-2891",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2891/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2891/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2891/index.md",
 "title": "Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Arbitrary Shortcode Execution via Quiz Answers, Contact Fields and Comments",
 "description": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to arbitrary shortcode execution via quiz answers, contact fields, question comments, quiz comments and Polar slider answers in all versions up to, and including, 11.3.0. This is due to the plugin sanitizing submitted values only with strip_shortcodes(), which leaves the escaped [[tag]] form intact so that it becomes a live shortcode when the results page runs do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example [qsm_result] to disclose other users' quiz results. Logged-in users could do the same through their own profile names in the %FULL_NAME% and %USER_NAME% template variables.",
 "plugin": {
  "slug": "quiz-master-next",
  "name": "Quiz and Survey Master (QSM)",
  "full_name": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
  "wordpress_org": "https://wordpress.org/plugins/quiz-master-next/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-master-next/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-master-next"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.3.1",
 "remediation": "Update to 11.3.1 or later.",
 "fix_released": "2026-11-11T10:38:37+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:29.032691+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2891/",
  "https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/",
  "https://wordpress.org/plugins/quiz-master-next/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-master-next",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}