CVE-2026-14821

LowCVSS 2.7

Published: 28/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Quiz and Survey Master (QSM) WordPress plugin before version 11.1.5 does not perform a capability check before deleting output templates. This allows users with contributor-level access and above to delete arbitrary templates.

Risk Assessment

The organization risks loss of custom templates, potentially disrupting quiz and survey functionality.

Recommendation

Immediately update the Quiz and Survey Master plugin to version 11.1.5 or later.

Original NVD description (English source)

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.