CVE-2026-96558

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker versions prior to 11.2.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. By submitting an over-length or duplicate qsm unique key value, an attacker can force the mlw results INSERT operation to fail. This action triggers an audit trail code branch that writes an unescaped payload via the qsm hidden questions parameter into wp mlw qm audit trail.form data, enabling the execution of arbitrary web scripts when a user accesses the affected page.

Recommendations Update to a version newer than 11.2.6. Avoid using the qsm hidden questions parameter until the update is applied.