# Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Arbitrary Shortcode Execution via Quiz Answers, Contact Fields and Comments

- **ID:** WPSEC-2026-2891
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** all versions before 11.3.1
- **Fixed in:** 11.3.1 (Update to 11.3.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2891/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to arbitrary shortcode execution via quiz answers, contact fields, question comments, quiz comments and Polar slider answers in all versions up to, and including, 11.3.0. This is due to the plugin sanitizing submitted values only with strip_shortcodes(), which leaves the escaped [[tag]] form intact so that it becomes a live shortcode when the results page runs do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, for example [qsm_result] to disclose other users' quiz results. Logged-in users could do the same through their own profile names in the %FULL_NAME% and %USER_NAME% template variables.

## References

- https://wpsec.com/vuln/WPSEC-2026-2891/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2891/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.