An improper neutralization of input during web page generation in ExpressTech Quiz And Survey Master allows for stored cross‑site scripting. If an attacker submits or edits quiz or survey content with malicious script, the plugin fails to sanitize the input before rendering it, allowing the script to be stored and later executed in the browsers of any user who views the content.

All deployments of the ExpressTech Quiz And Survey Master WordPress plugin up to and including version 11.2.7 are affected. Any installation using a version prior to 11.2.8 is vulnerable to this stored XSS attack.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker who can submit or edit quiz or survey content—such as a user with content‑creation privileges—injects a malicious script. When other site visitors load the affected content, the script runs in their browser context. Successful exploitation requires that the plugin store the injected payload without proper sanitization.