CVE-2026-14824: Unknown Quiz And Survey Master Qsm

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

Affected products

• Unknown Quiz And Survey Master Qsm: before 11.2.2 (fixed in 11.2.2)

Published 2026-08-04. Last modified 2026-08-26.