Read the docs
TI-2026-86436 Aliases CVE-2026-103917GHSA-h7jx-wqcx-pprg

Quiz and Survey Master (QSM) Unauthenticated Arbitrary Shortcode Execution

Priority LOW 35CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

The Quiz and Survey Master (QSM) plugin for WordPress by expresstech is vulnerable in all versions up to and including 11.2.7. The plugin does not properly validate a value before passing it to do_shortcode, which lets users run arbitrary shortcodes (CWE-94). An unauthenticated attacker can exploit this because the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint hands the submission nonce to any caller, so the nonce works as a CSRF token rather than an authorization barrier.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and imposes no meaningful obstacle to exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ExpressTechQuiz and Survey Master (QSM) – Quiz Maker & Survey Makerup to 11.2.7—No fix listedCNA
  • Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker VendorExpressTech Affected up to 11.2.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Quiz and Survey Master (QSM), Quiz Maker & Survey Maker.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-103917
  2. 2026-11-07 Alias added: GHSA-h7jx-wqcx-pprg
  3. 2026-11-08 Priority changed: MEDIUM → LOW
  4. 2026-11-08 CISA SSVC decision points changed

References

Other 6

  • TI-2020-18392 An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. CVSS 3.1CRITICAL 9.9
  • TI-2024-05207 Quiz And Survey Master < 9.0.2 - Contributor+ SQLi CVSS 3.1HIGH 8.8
  • TI-2024-05583 Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.5
  • TI-2024-09897 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2024-05932 Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
  • TI-2024-04590 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.5
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences