Weerawat Pawanawiwat

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker versions prior to 11.1.5 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can create, modify, and delete quiz output templates within the `mlw quiz output templates` database table. This flaw allows the storage of unsanitized HTML content, including arbitrary script tags. **Recommendations** Update the plugin to version 11.1.5 or later.