The ExpressTech Quiz And Survey Master plugin contains an improper neutralization of user input during web page generation, leading to a DOM‑based cross‑site scripting vulnerability. A malicious actor can embed crafted scripts into the quiz or survey responses that will be rendered in visitors’ browsers. This can result in session hijacking, defacement, or data theft, and the flaw is classified under CWE‑79. The vulnerability requires only client‑side code execution and does not involve server‑side changes.

This issue affects all WordPress sites that have the Quiz And Survey Master plugin version 11.2.7 or earlier. The plugin handles survey and quiz data within the WordPress environment; therefore, any installation using the affected versions is susceptible regardless of other plugins or themes.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is available, so the likelihood of exploitation is uncertain. Based on the description, the likely attack vector is a DOM‑based XSS that triggers when a site visitor loads a page containing crafted input; this can be achieved by visiting a malicious link or clicking on a social‑engineering email. If executed, the compromise would affect every visitor who loads the vulnerable content, since it is client‑side only.