CVE-2026-104391: Quiz And Survey Master Stored XSS Vulnerability

CVE-2026-104391 Overview

CVE-2026-104391 is a stored cross-site scripting (XSS) vulnerability in the ExpressTech Quiz And Survey Master (quiz-master-next) plugin for WordPress. The flaw affects all versions from the initial release through 11.2.7. Authenticated attackers with low privileges can inject malicious scripts that persist in the application and execute in the browsers of other users, including administrators. The vulnerability is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact

An authenticated attacker can store malicious JavaScript in quiz or survey content, hijacking administrator sessions and pivoting to full site compromise through persistent payload execution.

Affected Products

• ExpressTech Quiz And Survey Master (quiz-master-next) WordPress plugin
• All versions from n/a through 11.2.7
• WordPress sites running the vulnerable plugin build

Discovery Timeline

• 2026-10-07 - CVE-2026-104391 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104391

Vulnerability Analysis

The vulnerability resides in the Quiz And Survey Master plugin's handling of user-supplied input rendered in web pages. The plugin fails to properly neutralize input before it is reflected back into the DOM, allowing attackers to inject executable JavaScript. Because the payload is stored on the server, it executes every time a victim loads the affected page. Exploitation requires an attacker account with low privileges and relies on a victim loading the poisoned content, which triggers the scope change to the victim's browser context.

Root Cause

The root cause is missing or insufficient output encoding when plugin-managed data is rendered in HTML contexts. Input accepted through plugin interfaces is written to the page without escaping dangerous characters such as <, >, and quotation marks. This violates the output encoding guidance in CWE-79 and permits attacker-controlled markup to be parsed and executed by the browser.

Attack Vector

An authenticated attacker with contributor-level or similar privileges submits a crafted payload containing JavaScript through a plugin field. The payload is persisted in the WordPress database. When an administrator or other user views the page containing the stored data, the browser executes the attacker's script. Payloads can perform session theft, create rogue administrator accounts, modify plugin settings, or load secondary malware from attacker-controlled infrastructure. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2026-104391

Indicators of Compromise

• Unexpected <script> tags, on* event handlers, or javascript: URIs stored in quiz, survey, question, or answer fields managed by quiz-master-next.
• New or unexpected WordPress administrator accounts created shortly after a low-privileged user interacted with the plugin.
• Outbound HTTP requests from administrator browsers to unknown external domains after loading plugin pages.

Detection Strategies

• Audit the wp_postmeta and plugin-specific tables for HTML or JavaScript tokens in quiz content submitted by non-trusted users.
• Deploy a web application firewall rule that inspects POST parameters directed to plugin endpoints for script-injection patterns.
• Review web server access logs for suspicious POST activity to admin.php?page=mlw_quiz* and related plugin administrative endpoints.

Monitoring Recommendations

• Monitor WordPress audit logs for low-privileged accounts creating or editing quizzes and surveys.
• Alert on changes to WordPress user roles, option values, or newly registered users following plugin interaction.
• Track Content Security Policy (CSP) violation reports to identify inline script execution attempts in administrator sessions.

How to Mitigate CVE-2026-104391

Immediate Actions Required

• Update the Quiz And Survey Master plugin to a version later than 11.2.7 as soon as the vendor releases a fixed build.
• Review all existing quiz and survey content for injected scripts and sanitize or remove suspicious entries.
• Rotate administrator credentials and invalidate active sessions if indicators of exploitation are present.

Patch Information

At the time of publication, the vulnerability affects all releases up to and including 11.2.7. Refer to the Patchstack Vulnerability Report and the WordPress plugin repository for the latest patched release and upgrade instructions.

Workarounds

• Deactivate the Quiz And Survey Master plugin until a patched version is installed on production WordPress sites.
• Restrict user registration and limit contributor-level or higher privileges to trusted accounts only.
• Deploy a strict Content Security Policy that disallows inline scripts and unknown third-party script sources in the WordPress admin area.

# Configuration example: enforce a restrictive CSP header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"