The Quiz And Survey Master plugin for WordPress allows users to submit quiz answers that are not properly sanitized before being passed to the short‑code processor. Because the plugin calls do_shortcode() on the entire results page, any shortcodes embedded in user answers are executed. This flaw can be exploited by an unauthenticated attacker to inject shortcodes such as [qsm_result id=X], which then reveals the results of other users’ quizzes. The vulnerability is a form of authorization bypass that results in the disclosure of confidential user data.

Any WordPress site running Quiz and Survey Master version 11.1.0 or earlier, including all releases of the plugin up to that version. The affected component is the core plugin code that processes quiz answers and displays results. Users of this plugin are those who allow quiz participation without requiring authentication.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation probability until a public exploit becomes available. The exploit requires no special privileges and can be performed from any external web request containing a crafted quiz answer. The short‑code execution bypass makes the attack straightforward once the attacker identifies a target quiz. Because the flaw does not rely on any complex preconditions, it is likely to be discovered and used by attackers who wish to obtain users’ quiz submissions.