The plugin stores user‑supplied data without proper sanitization or escaping in the qsm_hidden_questions parameter, resulting in a stored DOM‑based XSS vulnerability. An unauthenticated attacker can inject arbitrary JavaScript that will run in the context of any page that includes the corrupted form data. This can allow the attacker to steal victim cookies, hijack sessions, or perform actions bound to the victim’s privileges.

Affects the expresstech "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker" WordPress plugin. Versions up to and including 11.2.6 are vulnerable. Any site running these version numbers and using the qsm_hidden_questions functionality or audit trail output is at risk. Versions newer than 11.2.6 are not known to contain this flaw.

The CVSS score of 7.2 indicates high severity. The exploit requires no user authentication and can be triggered by a visitor who submits an over‑length or duplicate qsm_unique_key value, causing the audit trail to write unescaped payload into the database. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the nature of stored XSS makes it a serious threat. Successful exploitation would let attackers execute malicious scripts with the privileges of the page’s visitor, potentially compromising sensitive data or spreading malware.