Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96558 · Microsoft / collected KEV context

cve-program · CVE-2026-96558

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0e344974-08c8-45a5-a0f4-3780ce00928b?source=cve
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.6/js/qsm-admin.js#L758
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.6/php/classes/class-qmn-quiz-manager.php#L3002
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.6/php/classes/class-qsm-audit.php#L36
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.6/php/admin/tools-page.php#L548
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.6/php/classes/class-qmn-quiz-manager.php#L2850
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3711419%40quiz-master-next&new=3711419%40quiz-master-next

No related operational record is retained in the current change model.