# CVE-2026-107862: ExpressTech Quiz And Survey Master DOM-based XSS

Source: https://junglewise.ai/threats/cve-2026-107862-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107862 · Severity: medium · CVSS 6.5 · Published 2026-10-12

Quiz And Survey Master is a WordPress plugin that allows site administrators to create quizzes and surveys. A DOM-based cross-site scripting vulnerability allows attackers who can interact with the plugin to inject malicious scripts that steal visitor data or hijack user accounts. The vulnerability affects versions up to 11.2.7 and is fixed in 11.2.8.

Technologies: [ExpressTech Quiz and Survey Master](https://junglewise.ai/threats/technologies/quiz-and-survey-master). Vendors: [ExpressTech](https://junglewise.ai/threats/vendors/expresstech).

## Quick answers

**Is CVE-2026-107862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107862 being exploited in the wild.

**How severe is CVE-2026-107862?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** ExpressTech Quiz and Survey Master through 11.2.7.

**Is there a fix for CVE-2026-107862?** Yes: fixed in 11.2.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107862 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107862?** Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.2.8

## Technical details

The vulnerability is a DOM-based XSS flaw in the Quiz And Survey Master WordPress plugin that allows improper neutralization of user input during web page generation. Exploitation requires user interaction and contributor-level privilege or above. An attacker can inject malicious scripts into the site that execute in visitors' browsers, potentially leading to account hijacking or data theft.

## Affected products

- ExpressTech Quiz And Survey Master through 11.2.7

## Timeline

- 2026-10-12: disclosed
- 2026-10-12: advisory
- 2026-10-12: patched: Version 11.2.8 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-7-cross-site-scripting-xss-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-7-cross-site-scripting-xss-vulnerability-2?_s_id=cve)

## Related threats

- [ExpressTech Quiz And Survey Master broken access control](https://junglewise.ai/threats/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and)
- [ExpressTech Quiz And Survey Master XSS in content injection](https://junglewise.ai/threats/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web)
- [ExpressTech Quiz And Survey Master object injection](https://junglewise.ai/threats/cve-2026-111408-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [ExpressTech Quiz And Survey Master object injection in deserialization](https://junglewise.ai/threats/cve-2026-104392-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [Quiz And Survey Master cross-site scripting](https://junglewise.ai/threats/cve-2026-97289-unauthenticated-cross-site-scripting-xss-in-quiz-and-survey)