# CVE-2026-14824: Quiz and Survey Master stored XSS in question settings

Source: https://junglewise.ai/threats/cve-2026-14824-quiz-and-survey-master-stored-xss-in-question-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14824 · Severity: medium · CVSS 4.8 · Published 2026-08-04

Quiz and Survey Master is a popular WordPress plugin for creating surveys and quizzes. A user with contributor-level access can inject malicious JavaScript into quiz questions that executes when any visitor views the quiz, potentially stealing credentials, session tokens, or other sensitive information from site visitors.

## Quick answers

**Is CVE-2026-14824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14824 being exploited in the wild.

**How severe is CVE-2026-14824?** Medium severity, with a CVSS score of 4.8, published 4 August 2026.

**Which products and versions are affected?** NextWP Quiz and Survey Master before 11.2.2.

**Is there a fix for CVE-2026-14824?** A patch was published on 2026-08-04: Fixed in version 11.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14824 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14824?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the plugin's question creation functionality. The vulnerable component fails to properly escape the "required" setting of polar-type questions before outputting it into an unquoted HTML attribute. An authenticated attacker with contributor-level access or above can inject arbitrary JavaScript via the REST API endpoint /wp-json/quiz-survey-master/v1/questions/. The payload breaks out of the unquoted data-is_required attribute and executes in the browser of any user viewing the quiz. The attack requires contributor-level access and a quiz embedded on a public page via the [mlw_quizmaster] shortcode. The vulnerability was fixed in version 11.2.2.

## Affected products

- NextWP Quiz and Survey Master before 11.2.2

## Timeline

- 2026-07-27: disclosed
- 2026-08-04: patched: Fixed in version 11.2.2

## References

- [https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/](https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/)