The Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.2 contain a CWE-79 Cross-Site Scripting vulnerability. This occurs because the plugin does not properly escape question settings before embedding them into unquoted HTML attributes. As a result, authenticated users with contributor-level permissions or above can inject malicious JavaScript code. This script executes in the context of any user who views the compromised quiz, potentially leading to session hijacking or other client-side attacks. No CVSS score or vendor advisory is currently available, and no patch or official remediation has been confirmed.

Users with contributor-level access or higher can inject arbitrary JavaScript code into quiz questions. This code executes in the browsers of users viewing the affected quizzes, potentially leading to theft of session tokens, defacement, or other malicious client-side actions. The vulnerability requires authenticated access at contributor level or above, limiting exposure to trusted users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling the affected plugin if possible to prevent exploitation.