This vulnerability (CVE-2026-97289) is an unauthenticated cross-site scripting (XSS) issue in the Quiz And Survey Master plugin for ExpressTech Systems, affecting versions up to 11.2.6. It stems from improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts.

An attacker can exploit this vulnerability remotely without authentication by tricking a user into interacting with crafted content, potentially leading to execution of arbitrary scripts in the victim's browser. This can result in disclosure of sensitive information, modification of data, or disruption of service within the affected application context.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation and output encoding controls where possible to mitigate XSS risks.