Vulnerabilities / Quiz and Survey Master (QSM) / WPSEC-2026-2895
Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via Polar Slider Value
Medium 5.3
CWE-20Fixed in 11.3.1
- ID
- WPSEC-2026-2895
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- all versions before 11.3.1
- Remediation
- Update to 11.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz and Survey Master (QSM) on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the Polar (slider) question answer in all versions up to, and including, 11.3.0, due to the submitted slider value being used directly as the question's points without checking that it is numeric or within the slider's configured range. This makes it possible for unauthenticated quiz takers to set arbitrary point values and inflate their stored quiz score.
References
- https://wpsec.com/vuln/WPSEC-2026-2895/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS