CVE-2026-5797 describes an injection vulnerability in the Quiz and Survey Master (QSM) WordPress plugin caused by insufficient neutralization of special elements in user input. The plugin sanitizes quiz answer text by removing HTML tags but does not encode or remove shortcode brackets, allowing attackers to inject arbitrary WordPress shortcodes. The plugin then executes these shortcodes on the quiz results page using do_shortcode(), including the injected ones, without performing authorization checks on the qsm_result shortcode. This flaw permits unauthenticated attackers to view other users' quiz submissions by injecting shortcodes such as [qsm_result id=X].

The vulnerability allows unauthenticated attackers to inject and execute arbitrary WordPress shortcodes within quiz results pages. This leads to unauthorized disclosure of other users' quiz submission data due to lack of authorization checks on the qsm_result shortcode. There is no direct impact on confidentiality of the WordPress site beyond quiz data, and no known impact on availability or integrity beyond the injection of shortcodes. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, administrators should consider disabling the Quiz and Survey Master plugin or restricting access to quiz results pages to trusted users only. Monitoring for suspicious shortcode injection attempts and applying custom filters to sanitize shortcode brackets in user input may reduce risk. Follow vendor advisories closely for updates and official patches.