CVE-2026-97289 in Quiz and Survey Master Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within the Quiz and Survey Master plugin for WordPress, affecting versions up to 11.2.6, represents a significant security risk due to its lack of authentication requirements. This specific characteristic allows any remote attacker who can access the target website's public-facing interface to exploit the vulnerability without needing valid credentials or prior login sessions. The core technical flaw typically stems from insufficient sanitization and validation of user-supplied input that is subsequently rendered in web pages served by the application. In this context, malicious scripts are injected into areas where the plugin processes survey responses, quiz submissions, or display configurations, bypassing standard security controls because no session verification is performed before processing these inputs.
From a technical perspective, the exploitation mechanism relies on the injection of executable JavaScript code through fields that accept raw input without proper encoding. When the application renders this data back to other users' browsers, the browser interprets the injected script as legitimate content originating from the trusted domain. This behavior aligns with CWE-79, which categorizes improper neutralization of input during web page generation. The absence of authentication lowers the barrier for entry significantly, enabling automated scanning tools and opportunistic attackers to target vulnerable instances at scale. Unlike authenticated XSS vulnerabilities that require social engineering or session hijacking to reach a privileged state, this unauthenticated variant can be triggered simply by directing a victim user with administrative privileges to a crafted URL containing the malicious payload.
The operational impact of such an exploit is severe, particularly when targeting WordPress administrators who possess elevated permissions within the platform. Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the vulnerable site, facilitating actions such as session hijacking through cookie theft, defacement of the website interface, or redirection of users to malicious phishing sites. Furthermore, if the administrator's browser is compromised via this vector, it may serve as a pivot point for further attacks against other administrative functions within the WordPress dashboard. This aligns with ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution, and potentially leads to credential access through techniques like T1539 if session cookies are exfiltrated without HttpOnly flags being properly enforced across all application components.
Mitigation strategies for this vulnerability must prioritize immediate patching of the Quiz and Survey Master plugin to a version newer than 11.2.6, where the input validation logic has been corrected by the developers. In scenarios where updating is not immediately feasible, administrators should implement web application firewall rules that detect and block common XSS payloads in query parameters or POST data associated with quiz and survey endpoints. Additionally, enforcing strict Content Security Policy headers can mitigate the impact of successful injection attempts by restricting script execution to trusted sources only. Regular security audits focusing on input handling across all public-facing forms are essential to prevent similar unauthenticated flaws from persisting within the application codebase.