CVE-2026-48867: Unauthenticated XSS in Quiz and Survey Master WordPress Plugin

Technical summary

CVE-2026-48867 is a stored or reflected XSS vulnerability (CWE-79) in Quiz and Survey Master versions up to 11.1.2. The plugin fails to properly sanitize or validate user-supplied input before rendering it in HTTP responses. Because no authentication is required, any unauthenticated attacker can craft a malicious request containing JavaScript payloads. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-based attack, low complexity, no privileges needed, and context-dependent user interaction required. The scope change (S:C) suggests the vulnerability can impact resources beyond the vulnerable component.

Business impact

Sites running vulnerable versions of Quiz and Survey Master face risk of account takeover, session hijacking, and malware distribution if visitors click attacker-controlled links. Quiz responses and user data could be exfiltrated. For organizations using the plugin for customer engagement, reputation damage and regulatory exposure (GDPR, CCPA) are concerns if user data is compromised. The ease of exploitation without authentication increases the likelihood of opportunistic attacks.

Affected systems

Quiz and Survey Master plugin versions 11.1.2 and earlier are affected. The vulnerability is relevant to WordPress administrators who have deployed this plugin. The CVE data does not specify which exact versions are patched or when remediation became available; consult the official plugin repository and vendor advisories for current version status and patching guidance.

Exploitability

The attack is readily exploitable because it requires no authentication, can be delivered over the network, and involves low complexity. However, successful exploitation depends on a user clicking an attacker-controlled link or visiting a compromised page, which is a realistic but not guaranteed scenario. The high CVSS score of 7.1 reflects the ease of delivery and multi-component impact, though user interaction is necessary.

Remediation

Update Quiz and Survey Master to the latest available version above 11.1.2 as soon as possible. Verify the patched version number against the official WordPress plugin directory and the vendor's security advisories. If an immediate update is not feasible, consider disabling the plugin temporarily or restricting access to quiz functionality until a patch can be applied.

Patch guidance

Navigate to WordPress plugin management, locate Quiz and Survey Master, and click 'Update' if a newer version is available. Automatic updates may already be pending; manually verify by checking the plugin version against the latest release on wordpress.org/plugins/quiz-survey-master. Test quiz functionality after patching to ensure no regression. If the plugin has not released a patched version above 11.1.2, escalate to the vendor or consider alternative quiz plugins.

Detection guidance

Monitor for reflected or stored XSS payloads in quiz submission data, survey responses, and user input fields. Review access logs for suspicious quiz URLs or parameters containing script tags, encoded payloads (e.g., %3Cscript%3E), or event handlers. Web application firewalls configured to block common XSS patterns should be deployed in front of WordPress instances. Conduct manual code review or use security scanning tools to identify unvalidated user input in the plugin's form handlers.

Why prioritize this

This vulnerability merits urgent attention despite not being on the KEV catalog because it is network-accessible, requires no authentication, affects a widely deployed WordPress plugin, and can lead to direct user compromise. The combination of ease of exploitation and broad exposure justifies rapid patching.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects an attack that is trivial to deliver (network, low complexity, no privileges) but requires user interaction and results in partial compromise of confidentiality, integrity, and availability. The scope-change designation indicates the impact extends beyond the vulnerable component itself. This is a significant risk that warrants prioritization above critical infrastructure patches but may be managed alongside other HIGH-severity issues depending on your plugin footprint.

Frequently asked questions