# CVE-2026-125786: ExpressTech Quiz And Survey Master XSS in content injection

Source: https://junglewise.ai/threats/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-125786 · Severity: medium · CVSS 5.3 · Published 2026-11-12

The Quiz And Survey Master WordPress plugin allows quiz creators to design and deploy surveys on their websites. An unauthenticated attacker can inject malicious scripts into quiz content, which are then executed in the browsers of site visitors, enabling account takeover, credential theft, or malware distribution. The vulnerability affects all versions through 11.3.0.

Technologies: [ExpressTech Quiz and Survey Master](https://junglewise.ai/threats/technologies/quiz-and-survey-master). Vendors: [ExpressTech](https://junglewise.ai/threats/vendors/expresstech).

## Quick answers

**Is CVE-2026-125786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125786 being exploited in the wild.

**How severe is CVE-2026-125786?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** ExpressTech Quiz and Survey Master through 11.3.0.

**Is there a fix for CVE-2026-125786?** Yes: fixed in 11.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125786 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-125786?** Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.3.1

## Technical details

The plugin improperly neutralizes script-related HTML tags in user-supplied content, resulting in a basic cross-site scripting (XSS) vulnerability. An unauthenticated attacker can inject arbitrary HTML and JavaScript through quiz or survey fields, which execute in the context of website visitors' browsers. The flaw allows code injection without authentication or user interaction beyond visiting an affected page.

## Affected products

- ExpressTech Quiz And Survey Master through 11.3.0

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve)

## Related threats

- [ExpressTech Quiz And Survey Master broken access control](https://junglewise.ai/threats/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and)
- [ExpressTech Quiz And Survey Master object injection](https://junglewise.ai/threats/cve-2026-111408-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [ExpressTech Quiz And Survey Master DOM-based XSS](https://junglewise.ai/threats/cve-2026-107862-improper-neutralization-of-input-during-web-page-generation)
- [ExpressTech Quiz And Survey Master object injection in deserialization](https://junglewise.ai/threats/cve-2026-104392-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [Quiz And Survey Master cross-site scripting](https://junglewise.ai/threats/cve-2026-97289-unauthenticated-cross-site-scripting-xss-in-quiz-and-survey)