The vulnerability arises because the Quiz and Survey Master plugin fails to escape a question setting before rendering it inside an unquoted HTML attribute. This omission allows an attacker with contributor‑level permission and above to inject arbitrary JavaScript that will execute in the browsers of any user who views the affected quiz. The injected code can steal session cookies, deface content, or perform other malicious actions that compromise the confidentiality and integrity of user sessions. The impact is a stored cross‑site scripting (XSS) that affects all users who access the compromised quiz pages.

Any WordPress site that has the Quiz and Survey Master plugin installed at a version earlier than 11.2.2 is affected. The plugin comes from the vendor listed as Unknown:Quiz and Survey Master (QSM). No specific version numbers beyond the cutoff are provided, so all builds before 11.2.2 should be considered vulnerable.

The CVSS details are not supplied, but the lack of proper escaping results in a high‑impact stored XSS. An attacker must first have contributor‑level or higher access to create or edit a quiz. Once the malicious payload is stored, any visitor to the quiz page will trigger the script, making it a widespread client‑side attack vector. Because the exploit occurs automatically when a user loads the page and no interaction beyond browsing is required, the practical exploitation likelihood is high for sites that allow contributors to modify quizzes. The vulnerability is not currently listed in CISA’s KEV catalog and the EPSS score is unavailable, suggesting no publicly documented exploits yet, but the inherent risk remains significant.