CVE-2026-48867: WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a stored or reflected cross-site scripting (XSS) vulnerability in the Quiz And Survey Master WordPress plugin, affecting all versions up to and including 11.1.2. The flaw is reachable over the network without any authentication, but requires a victim to interact with crafted content, such as visiting a malicious URL or viewing injected markup. Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser session, potentially reading session data, altering page content, or disrupting the user's experience. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted requests to the public-facing WordPress installation without needing prior access.

• AuthenticationNot required

  No account or credentials of any kind are needed to deliver the malicious payload to the target application.

• Victim interactionRequired

  A victim must take an action such as clicking a crafted link or loading a page containing injected content for the JavaScript payload to execute in their browser.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental factors need to align for the attack to succeed.

Blast Radius

• An attacker can execute arbitrary JavaScript in the victim's browser session, reading cookies, session tokens, or other authentication material stored in the browser.
• Page content visible to the victim can be modified, enabling phishing overlays, fake login forms, or redirection to attacker-controlled sites.
• The victim's browser can be used to issue authenticated requests to the WordPress site on the attacker's behalf, potentially altering site content or settings the victim has permission to change.
• The CVSS availability impact token indicates a low disruption to the affected component, meaning the injected script can interfere with the normal rendering or function of the page the victim is viewing.