Quiz and Survey Master (QSM)

Quiz and Survey Master before 11.2.2 outputs a question setting into an unquoted HTML attribute without proper escaping. A Contributor can store a value that breaks out of the attribute and injects JavaScript, which executes for any user who views the affected quiz. The public advisory does not disclose the setting, save endpoint, request parameter, output attribute or rendering function.

Quiz and Survey Master before 11.1.5 omits a capability check from its output-template deletion operation. Any authenticated Contributor can select and delete arbitrary QSM output templates, allowing a low-privilege account to disrupt or alter quiz and survey presentation. The WPScan CNA record does not disclose the endpoint, action, template identifier parameter or deletion function.

Quiz and Survey Master before 11.1.3 exposes a front-end credential-check flow without rate limiting or useful audit controls and returns distinguishable responses for valid and invalid users. An unauthenticated attacker can use those response differences to enumerate usernames and repeatedly test passwords, potentially taking over an account whose credentials are guessed. The CNA record does not disclose the route, action, parameter names or validation function.

Quiz and Survey Master (QSM) is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.