CVE-2026-9233 is an authorization bypass vulnerability (CWE-862) in the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. The plugin fails to properly verify user authorization for actions on quiz output templates stored in the mlw_quiz_output_templates database table. As a result, authenticated users with contributor-level privileges or above can manipulate these templates, including injecting unsanitized HTML and script tags. This vulnerability affects all versions up to and including 11.1.4. The CVSS 3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, and requiring low privileges but no user interaction.

An attacker with contributor-level access or higher can bypass authorization controls to create, modify, or delete quiz output templates. This can lead to the injection of arbitrary HTML and script content, potentially enabling cross-site scripting (XSS) or other content injection attacks. There is no direct confidentiality or availability impact indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access where possible and monitor for suspicious activity related to quiz output templates. Avoid granting contributor or higher privileges to untrusted users.