CVE-2026-11780

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker versions prior to 11.2.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the question title parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update to version 11.2.2 or later. Restrict the use of the question title parameter for users with contributor-level access as a temporary mitigation.