An unauthenticated attacker can exploit the plugin's DOM‑based XSS flaw by injecting and executing arbitrary JavaScript within the site’s context. The flaw arises from improper neutralization of input during web page generation in ExpressTech Quiz And Survey Master quiz‑master‑next, allowing malicious scripts to be inserted via quiz fields. This can lead to cookie theft, session hijacking, defacement, or other malicious actions, potentially compromising site confidentiality and integrity. The vulnerability affects all versions up to 11.2.6.

The vulnerability affects the ExpressTech Systems Quiz And Survey Master plugin for WordPress, versions 11.2.6 and earlier. All sites running an affected version are exposed; no other vendors or products are listed.

The CVSS score of 7.1 indicates a moderate‑to‑high risk. The EPSS score is 0.00146 (<1%) and the flaw is not yet listed in CISA KEV, but the unauthenticated nature and wide usage of the plugin make exploitation likely. Attackers can target sites by navigating to quiz pages or by inserting malicious payloads into the plugin’s fields, which are rendered without proper sanitization. Prompt mitigation is therefore recommended.