CVE-2026-5797 is an injection vulnerability (CWE-74) in the Quiz And Survey Master WordPress plugin (up to version 11.1.0). User-submitted quiz answers are sanitized only by sanitize_text_field() and htmlspecialchars(), which do not remove shortcode brackets. When displaying quiz results, the plugin calls do_shortcode() on the entire output, including user answers, allowing execution of arbitrary shortcodes. Attackers can exploit this to inject shortcodes such as [qsm_result id=X] to access other users' quiz results without authorization, due to missing authorization checks in the shortcode handler.

An unauthenticated attacker can inject arbitrary WordPress shortcodes via quiz answers, leading to unauthorized access to other users' quiz submissions. This compromises user privacy and data confidentiality within the affected plugin. There is no direct impact on system availability or integrity reported. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the Quiz And Survey Master plugin or restricting quiz answer inputs to trusted users. Monitoring plugin updates from expresstech is recommended to apply an official fix once released. Avoid using untrusted user input in shortcode execution contexts.