Description
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
Published: 2026-06-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated Cross‑Site Scripting flaw exists in WordPress Quiz And Survey Master plugin versions 11.0.0 and earlier, allowing an attacker to inject arbitrary client‑side code into the plugin’s output. The impact is limited to the browser of any user who loads the vulnerable content; this conclusion is inferred from the nature of XSS and is not explicitly stated in the description.

Affected Systems

The flaw affects the ExpressTech WordPress Quiz And Survey Master plugin running versions 11.0.0 or earlier. No other products or versions are mentioned as vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating medium‑to‑high severity, and an EPSS score of less than 1 %, indicating a low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the plugin’s publicly accessible interface where malicious payloads can be injected.

Generated by OpenCVE AI on June 18, 2026 at 07:14 UTC.

Remediation

Vendor Solution

Update the WordPress Quiz And Survey Master Plugin to the latest available version (at least 11.1.0).

OpenCVE Recommended Actions

  • Upgrade the WordPress Quiz And Survey Master plugin to version 11.1.0 or later, which contains the vendor‑supplied fix for the XSS vulnerability.
  • If an upgrade is not immediately feasible, disable or delete the plugin from the site to eliminate the vulnerable code path.
  • Review other installed WordPress plugins for potential input‑validation weaknesses and apply available updates or implement sanitization on any custom form fields.

Generated by OpenCVE AI on June 18, 2026 at 07:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 16 Jun 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Expresstech
Expresstech quiz And Survey Master
Wordpress
Wordpress wordpress
Vendors & Products Expresstech
Expresstech quiz And Survey Master
Wordpress
Wordpress wordpress
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
Title WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Expresstech Quiz And Survey Master
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-16T01:29:22.335Z

Reserved: 2026-04-15T09:20:42.117Z

Link: CVE-2026-40787

cve-icon Vulnrichment

Updated: 2026-06-16T01:29:17.820Z

cve-icon NVD

Status : Deferred

Published: 2026-06-15T21:16:50.943

Modified: 2026-06-15T21:24:32.790

Link: CVE-2026-40787

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T07:15:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')