{
 "id": "WPSEC-2026-2895",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2895/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2895/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2895/index.md",
 "title": "Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via Polar Slider Value",
 "description": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the Polar (slider) question answer in all versions up to, and including, 11.3.0, due to the submitted slider value being used directly as the question's points without checking that it is numeric or within the slider's configured range. This makes it possible for unauthenticated quiz takers to set arbitrary point values and inflate their stored quiz score.",
 "plugin": {
  "slug": "quiz-master-next",
  "name": "Quiz and Survey Master (QSM)",
  "full_name": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
  "wordpress_org": "https://wordpress.org/plugins/quiz-master-next/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-master-next/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-master-next"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.3.1",
 "remediation": "Update to 11.3.1 or later.",
 "fix_released": "2026-11-11T10:38:37+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:29.032691+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2895/",
  "https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/",
  "https://wordpress.org/plugins/quiz-master-next/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-master-next",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}