Junglewise Threat Intelligence

CVE-2026-9233: Quiz and Survey Master WordPress plugin authorization bypass

CVE-2026-9233 · Severity: medium · CVSS 4.3 · Published 2026-06-27

Technologies: ExpressTech Quiz and Survey Master. Vendors: ExpressTech.

Executive brief

The Quiz and Survey Master plugin for WordPress, which is used to create and manage online quizzes and surveys, contains a security flaw in how it checks user permissions. This allows logged-in users with low-level access (such as contributors) to modify or delete quiz templates. An attacker could use this to disrupt survey operations or inject malicious scripts into quiz pages, potentially affecting site visitors.

Technical details

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in versions up to and including 11.1.4. The vulnerability exists because the plugin does not properly verify user permissions before allowing actions on the mlw_quiz_output_templates database table. Authenticated attackers with contributor-level permissions or higher can exploit this flaw via network requests to create, modify, or delete quiz output templates. Furthermore, the lack of sanitization allows for the storage of arbitrary HTML and script tags, potentially leading to stored cross-site scripting (XSS). A patch was released in version 11.1.5.

Affected products

  • expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker up to, and including, 11.1.4

Timeline

  • 2026-06-27: disclosed
  • 2026-06-27: advisory

References

Related threats