The Quiz and Survey Master plugin for WordPress contains an authorization bypass in its AJAX action qsm_insert_quiz_template. The code does not verify that the caller has sufficient privileges before storing data in the mlw_quiz_output_templates table. As a result, any authenticated WordPress user with the contributor role or higher can create, edit, or delete quiz templates. The plugin accepts arbitrary HTML, so an attacker can inject malicious script tags that are rendered whenever the template is used, potentially leading to stored cross‑site scripting from the perspective of site visitors.

The vulnerability affects the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions up to and including 11.1.4. The plugin is commonly installed on WordPress sites that use quizzes and surveys, and the unauthorized modification capability applies to all users who can authenticate with WordPress and possess contributor-level access or higher, regardless of site configuration.

The CVSS score of 4.3 indicates a moderate risk level. EPSS is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor role or above; the attacker would send crafted AJAX requests to the qsm_insert_quiz_template endpoint, allowing storage of unsanitized HTML and potentially causing stored XSS to the site’s visitors.