# Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via Polar Slider Value

- **ID:** WPSEC-2026-2895
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** all versions before 11.3.1
- **Fixed in:** 11.3.1 (Update to 11.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2895/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the Polar (slider) question answer in all versions up to, and including, 11.3.0, due to the submitted slider value being used directly as the question's points without checking that it is numeric or within the slider's configured range. This makes it possible for unauthenticated quiz takers to set arbitrary point values and inflate their stored quiz score.

## References

- https://wpsec.com/vuln/WPSEC-2026-2895/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2895/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.