CVE-2026-14824 Overview
CVE-2026-14824 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Quiz and Survey Master (QSM) WordPress plugin in versions prior to 11.2.2. The plugin fails to escape a question setting before rendering it into an unquoted HTML attribute. Contributor-level users and above can inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz. The flaw is tracked under [CWE-79] and requires authenticated access with user interaction to exploit.
Critical Impact
Authenticated contributors can execute arbitrary JavaScript in visitors' browsers, enabling session theft, credential harvesting, and administrative account takeover through crafted quiz content.
Affected Products
- Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.2
- WordPress sites permitting contributor-level or higher user registration
- Any WordPress installation running QSM with published quizzes
Discovery Timeline
- 2026-08-04 - CVE-2026-14824 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-14824
Vulnerability Analysis
The vulnerability resides in the QSM plugin's quiz question rendering logic. The plugin accepts a question setting value from authenticated users and outputs it directly into an HTML attribute without proper escaping. Because the attribute is unquoted, an attacker does not need to break out of quote delimiters. Injecting whitespace followed by event handler attributes such as onmouseover or onfocus is sufficient to execute JavaScript.
The attack requires contributor-level privileges, meaning the attacker must have an authenticated account on the target WordPress site. Once malicious payload is stored in the quiz question configuration, any user viewing the quiz triggers script execution. This includes administrators reviewing pending content, escalating the impact from contributor to full administrative compromise.
Stored XSS in WordPress plugins commonly leads to session cookie exfiltration, forced administrative actions via CSRF chains, and injection of persistent backdoors through plugin or theme editors.
Root Cause
The root cause is missing output encoding in the code path that renders question settings into HTML attributes. WordPress provides esc_attr() for exactly this purpose, but the affected code omits the call. The use of an unquoted attribute compounds the issue by broadening the set of characters that can terminate the attribute context.
Attack Vector
The attack vector is network-based and requires an authenticated contributor account plus user interaction from a victim who loads the affected quiz page. An attacker creates or edits a quiz question and injects a payload into the vulnerable setting field. When a higher-privileged user views the quiz in the WordPress admin or on the front end, the script executes with that user's session context.
The vulnerability manifests as unquoted HTML attribute injection. See the WPScan Vulnerability Report for technical details on the affected setting and payload construction.
Detection Methods for CVE-2026-14824
Indicators of Compromise
- Quiz question settings containing HTML event handler attributes such as onmouseover=, onclick=, onerror=, or onfocus=
- Unexpected <script> tags or JavaScript strings stored in the wp_qsm_questions database table
- New administrator accounts created shortly after quiz page views by existing admins
- Outbound HTTP requests from admin browsers to unfamiliar domains carrying WordPress session cookies
Detection Strategies
- Query the QSM database tables for question settings containing suspicious characters including <, >, =, and known event handler names
- Deploy Content Security Policy (CSP) reporting to identify inline script execution attempts on quiz pages
- Monitor WordPress audit logs for quiz creation and modification events by contributor-level accounts
- Inspect rendered quiz HTML for unquoted attributes containing unexpected whitespace or handler syntax
Monitoring Recommendations
- Enable WordPress activity logging plugins to track content edits by low-privilege users
- Alert on privilege changes to WordPress accounts within 24 hours of quiz interactions by administrators
- Correlate web server logs for admin-ajax.php calls originating from admin sessions immediately after quiz page loads
- Review contributor account registrations for anomalous patterns preceding quiz submissions
How to Mitigate CVE-2026-14824
Immediate Actions Required
- Update the Quiz and Survey Master plugin to version 11.2.2 or later on all WordPress installations
- Audit existing quiz questions for injected JavaScript payloads and remove malicious content
- Review contributor and author accounts for unauthorized additions and reset credentials for suspicious accounts
- Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Patch Information
The vendor has released QSM version 11.2.2, which properly escapes the affected question setting before output. Site operators should apply the update through the WordPress plugin dashboard or by downloading the fixed release from the official plugin repository. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict contributor and author account creation until the plugin is patched
- Temporarily disable the QSM plugin on sites that cannot immediately apply the update
- Deploy a web application firewall rule to strip event handler attributes from POST requests targeting QSM admin endpoints
- Enforce a strict Content Security Policy that disallows inline script execution on pages rendering quiz content
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
