CVE-2026-14825
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Risk Assessment
Unauthorized modification of quiz settings can lead to content manipulation and potential injection of malicious code.
Recommendation
Update the Quiz and Survey Master plugin to version 11.2.4 or later, which includes security fixes.
Original NVD description (English source)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.