CVE-2023-3575
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Quiz And Survey Master WordPress plugin before version 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or account takeover.
Recommendation
It is recommended to update the plugin to the latest version 8.1.11 or higher to mitigate this vulnerability.
Other vulnerabilities in Quiz And Survey Master WordPress plugin
See all- CVE-2026-79615Low
The Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes. Users with a role as low as Contributor can read the questions, hints and correct answer keys of quizzes belonging to other users.
- CVE-2026-14824Medium
The Quiz and Survey Master (QSM) WordPress plugin before version 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute. This allows users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Original NVD description (English source)
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Vulnerability data from NVD (NIST) · CISA KEV · EPSS