{
 "id": "WPSEC-2026-2893",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2893/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2893/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2893/index.md",
 "title": "Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via qsm_hidden_questions Parameter",
 "description": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.3.0, due to the plugin trusting the client-supplied list of hidden questions, which excludes those questions from both the earned points and the percentage denominator. This makes it possible for unauthenticated quiz takers to exclude questions they answered incorrectly and inflate their stored quiz score.",
 "plugin": {
  "slug": "quiz-master-next",
  "name": "Quiz and Survey Master (QSM)",
  "full_name": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
  "wordpress_org": "https://wordpress.org/plugins/quiz-master-next/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-master-next/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-master-next"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.3.1",
 "remediation": "Update to 11.3.1 or later.",
 "fix_released": "2026-11-11T10:38:37+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:29.032691+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2893/",
  "https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/",
  "https://wordpress.org/plugins/quiz-master-next/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-master-next",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}