PT-2026-33411 · WordPress · Quiz/Survey Master
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Quiz And Survey Master versions prior to 11.1.1
Description
Insufficient input sanitization allows for arbitrary shortcode execution. The issue occurs because user-submitted quiz answer text is processed by
sanitize text field() and htmlspecialchars(), which remove HTML tags but fail to encode or remove shortcode brackets. When quiz results are displayed, the plugin uses the do shortcode() function on the output, executing any injected shortcodes. Unauthenticated attackers can use this to inject shortcodes such as '[qsm result id=X]' to access other users' quiz submissions without authorization, as the qsm result shortcode does not perform authorization checks.Recommendations
Update to a version later than 11.1.0.
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Quiz/Survey Master