CyberRota Analysis
AI-GeneratedThe Quiz and Survey Master WordPress plugin prior to version 11.2.2 is vulnerable due to improper escaping of question settings, enabling users with contributor-level access and higher to inject arbitrary JavaScript into unquoted HTML attributes. This flaw allows for cross-site scripting (XSS) attacks, potentially compromising the security of any user viewing the affected quiz. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate the risk.
Original NVD Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.