An unauthenticated Cross‑Site Scripting flaw exists in versions of the WordPress Quiz And Survey Master plugin up to 11.0.0. The vulnerability allows any web‑visitor to inject arbitrary client‑side script into the plugin’s output, potentially leading to session hijacking, cookie theft, defacement, or the execution of malicious actions in the context of other site users. The weakness is classified as CWE‑79, a classic injection problem that bypasses normal input validation. Because the attack is client‑side, the impact is limited to the victim’s browser but can be leveraged to compromise any authenticated user who subsequently visits the vulnerable content.

The security advisory targets the ExpressTech WordPress Quiz And Survey Master plugin, specifically installations running versions 11.0.0 or earlier. No other products or versions are mentioned as affected.

The vulnerability carries a CVSS score of 7.1, indicating a medium‑to‑high severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the plugin’s publicly accessible interface, where malicious payloads can be injected.