CVE-2026-14824 is a CWE-79 Cross-Site Scripting vulnerability in the Quiz and Survey Master (QSM) WordPress plugin. Versions prior to 11.2.2 do not properly escape a question setting before embedding it into an unquoted HTML attribute. This allows users with contributor-level privileges or above to inject arbitrary JavaScript code that executes in the context of any user viewing the quiz, potentially leading to session hijacking or other client-side attacks. The vulnerability requires user interaction (viewing the quiz) and privileges to create or modify quiz questions.

An attacker with contributor-level access or higher can inject malicious JavaScript code into quiz questions, which executes in the browsers of users who view the affected quiz. This can lead to information disclosure or session hijacking of those users. The vulnerability does not allow direct remote code execution on the server or denial of service. The CVSS score of 4.8 reflects a medium severity with low complexity and limited impact confined to client-side code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 11.2.2, upgrading to version 11.2.2 or later is recommended once the vendor releases a fix. Until then, restrict contributor-level access to trusted users and avoid publishing quizzes created by contributors. Monitor official vendor channels for updates and patches.