CVE-2026-96558 Overview
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress contains a Stored DOM-Based Cross-Site Scripting vulnerability [CWE-79] affecting all versions up to and including 11.2.6. The flaw resides in the handling of the qsm_hidden_questions parameter, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who later accesses an affected page. Exploitation requires the attacker to trigger the audit trail fallback by forcing the primary mlw_results INSERT to fail.
Critical Impact
Unauthenticated attackers can store malicious JavaScript in wp_mlw_qm_audit_trail.form_data that executes against administrators and site visitors viewing the affected pages.
Affected Products
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress
- All versions up to and including 11.2.6
- WordPress sites with the plugin active and quiz submissions enabled
Discovery Timeline
- 2026-10-10 - CVE-2026-96558 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-96558
Vulnerability Analysis
The vulnerability is a Stored DOM-Based Cross-Site Scripting flaw in the quiz submission workflow. When a user submits a quiz, QSM attempts to record the result in the wp_mlw_qm_results table through an mlw_results INSERT operation. If this INSERT fails, the code falls back to an audit trail branch that persists submission data, including the qsm_hidden_questions parameter, into wp_mlw_qm_audit_trail.form_data without sanitization or output escaping. The stored payload is subsequently reflected into the DOM when administrators or users render pages that consume audit trail data, resulting in script execution in the victim's browser.
Root Cause
The underlying defect is missing input sanitization on the qsm_hidden_questions request parameter and missing output escaping when the audit trail record is rendered. The audit-writing branch in class-qsm-audit.php and the quiz submission handlers in class-qmn-quiz-manager.php write user-controlled form data verbatim, trusting a code path that was never intended to receive attacker-reachable input.
Attack Vector
An unauthenticated attacker submits a quiz request containing a crafted qsm_hidden_questions payload. To reach the vulnerable branch, the attacker forces the primary mlw_results INSERT to fail by supplying an over-length or duplicate qsm_unique_key value. The failure diverts execution to the audit trail write, which stores the unescaped payload. When a privileged user later views pages that render audit data, the script executes with that user's session context, enabling account takeover, settings tampering, or further pivoting.
The vulnerability mechanism is documented in the referenced source files. See the Quiz Master Next Quiz Manager Class and the Quiz Master Next Audit Class for the exact code paths.
Detection Methods for CVE-2026-96558
Indicators of Compromise
- Rows in wp_mlw_qm_audit_trail where form_data contains <script>, onerror=, javascript:, or encoded script fragments.
- Quiz submissions where qsm_unique_key is abnormally long or duplicates an existing key, indicating a forced INSERT failure.
- Unexpected administrator session activity, new admin accounts, or plugin option changes shortly after public quiz submissions.
Detection Strategies
- Query the wp_mlw_qm_audit_trail table for suspicious markup in the form_data column and alert on matches.
- Inspect web server access logs for POST requests to QSM submission endpoints that contain HTML entities or script tags in the qsm_hidden_questions parameter.
- Correlate failed mlw_results INSERT events with subsequent audit trail writes from the same source IP.
Monitoring Recommendations
- Enable WordPress audit logging to capture administrator actions following quiz submissions from unauthenticated sources.
- Monitor outbound requests from administrator browsers for unexpected destinations that may indicate active XSS payload execution.
- Track plugin version inventory across WordPress estates to identify installations still running QSM 11.2.6 or earlier.
How to Mitigate CVE-2026-96558
Immediate Actions Required
- Update the Quiz and Survey Master plugin to the version released after 11.2.6 that contains the fix referenced in the plugin changeset.
- Review and purge malicious entries from the wp_mlw_qm_audit_trail table before administrators view the data.
- Rotate administrator credentials and invalidate active sessions if audit trail entries contain suspicious payloads.
Patch Information
The vendor committed a fix in the plugin changeset referenced in the Quiz Master Next Changeset. Additional analysis is available in the Wordfence Vulnerability Report. Site operators should upgrade to the patched release through the WordPress plugin updater.
Workarounds
- Temporarily deactivate the Quiz and Survey Master plugin until the patched version is deployed.
- Deploy a Web Application Firewall rule that blocks requests containing HTML or script tokens in the qsm_hidden_questions parameter.
- Restrict access to quiz submission endpoints with authentication or IP allow-listing where business requirements allow.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
