CVE-2026-104391 in Quiz and Survey Master Plugin
Summary
by MITRE • 10/07/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting or XSS. Specifically, this flaw manifests within the ExpressTech Quiz and Survey Master plugin for WordPress, affecting versions ranging from n/a through 11.2.7. The core technical deficiency lies in the application's failure to adequately sanitize user-supplied input before it is rendered back into web pages without proper encoding. This oversight allows an attacker to inject malicious client-side scripts that are subsequently stored on the target server and executed by other users who view the affected content, classifying this as a Stored XSS vulnerability rather than a reflected or DOM-based variant.
In operational terms, the presence of this flaw enables attackers to achieve persistent unauthorized access to user sessions and sensitive data within the WordPress environment. Because the malicious script is stored on the server, it does not require complex social engineering tactics such as crafting specific URLs for each victim; instead, any authenticated administrator or even public users depending on the plugin's configuration who view the compromised quiz or survey will trigger the execution of the injected code in their browsers. This persistence significantly amplifies the risk profile compared to temporary XSS flaws, as the attack vector remains active until the malicious content is manually removed from the database by an administrator.
The impact of this vulnerability extends beyond simple script execution. Attackers can leverage Stored XSS to perform session hijacking by stealing authentication cookies and tokens, thereby gaining full control over user accounts with varying privilege levels within the WordPress installation. Furthermore, the injected scripts can facilitate phishing attacks by displaying fake login forms that capture credentials for other services or manipulate the page content to deface the website. In more sophisticated scenarios, the vulnerability can be chained with other weaknesses to execute arbitrary code on the server if combined with file upload vulnerabilities or used to conduct cross-site request forgery actions against administrative endpoints, effectively compromising the integrity and confidentiality of the entire web application ecosystem.
From a classification perspective, this issue aligns directly with CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting in the Common Weakness Enumeration database. It also maps to specific tactics within the MITRE ATT&CK framework for enterprise security, particularly T1059.007 JavaScript under Command and Control or Execution techniques, as well as T1213 Data from Information Repositories if used to exfiltrate stored data. The persistence of the payload places it firmly in the realm of long-term compromise scenarios where defenders must monitor for anomalous script injections rather than just transient network anomalies.
Mitigation strategies require immediate action by system administrators and developers maintaining instances of Quiz And Survey Master. The primary remediation step is to upgrade the plugin to version 11.2.8 or later, where the vendor has presumably implemented proper input validation and output encoding mechanisms such as HTML entity encoding for all user-supplied data before rendering it in the browser context. For environments that cannot be immediately updated due to compatibility constraints, defense-in-depth measures should be employed. These include implementing a Web Application Firewall configured with rulesets specifically tuned to detect and block XSS payloads in POST requests associated with quiz submissions or survey responses. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby neutralizing many potential exploitation vectors even if the underlying code flaw remains present until a patch is applied.