CVE-2026-14824
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 04, 2026
Vendor
unknown
Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.