CVE-2026-103917

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker versions prior to 11.2.8

Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before executing the do shortcode() function. The wp ajax nopriv qsm create quiz nonce endpoint provides a submission nonce to any unauthenticated caller, which allows it to be used as a CSRF (Cross-Site Request Forgery) token—a technique used to trick a user into executing unwanted actions—rather than acting as a security barrier.

Recommendations Update to a version newer than 11.2.7.