CVE-2026-103917

Description

The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and imposes no meaningful obstacle to exploitation.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 6.5 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Effective score: 6.5 / 10 MEDIUM source: CNA overview
CWE(s): CWE-94
Reserved: 2026-10-01
Published: 2026-11-07 06:39 UTC
Last updated: 2026-11-07 06:39 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103917.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-07 07:17:01 UTC
NVD last modified: 2026-11-07 07:17:02 UTC
NVD CVSS v3.1: 6.5 / 10 MEDIUM source: security@wordfence.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 2.5 / 10
EPSS score: 0.0028 (probability of exploitation in next 30 days)
EPSS percentile: 20.60% vs all CVEs — higher = more likely to be exploited, as of 2026-11-07

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-118958

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
expresstech	Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker	`0` (affected)	—

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (6)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L2866 security@wordfence.com
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L517 security@wordfence.com
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L536 security@wordfence.com
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/renderer/frontend/class-qsm-new-renderer.php#L244 security@wordfence.com
https://plugins.trac.wordpress.org/changeset?reponame=&old=3729156%40quiz-master-next&new=3729156%40quiz-master-next security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/020209b3-2175-4509-836a-8a60ed4f4b15?source=cve security@wordfence.com

Remediations (10)

October 2026 Critical Patch Update Released | security

web:blogs.oracle.com

For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-08 11:47 UTC
Tenable Patch Management 2026 Release Notes

web:docs.tenable.com

These release notes summarize updates made to Tenable Patch Management in 2026 and are listed in reverse chronological order. Expand All

2026-11-08 11:47 UTC
2026 Catalog Release History - Patch My PC

web:patchmypc.com

You can find the production release history below for 2026 . View the 2025 Catalog Release History.

2026-11-08 11:47 UTC
Cisco Meraki Security Hardening Release: October 2026

web:sec.cloudapps.cisco.com

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...

2026-11-08 11:47 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:47 UTC
PHP2Shell: The Emergency PHP Patch Is Out - techaeris.com

web:techaeris.com

PHP2Shell, the two critical PHP remote code execution flaws leaked a day early, now has an emergency patch . Here is what shipped, what is still exposed, and what to do.

2026-11-08 11:47 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-08 11:47 UTC
Oracle Critical Patch Update Advisory - October 2026

web:www.oracle.com

This Critical Patch Update contains 1295 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2026 Critical Patch Update: Executive Summary and Analysis.

2026-11-08 11:47 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-08 11:47 UTC
CVE-2026-103917: Remote Code Execution (RCE) - Analysis & Fix ...

web:www.thehackerwire.com

How do I fix or mitigate CVE-2026-103917 ? To protect against CVE-2026-103917 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-11-08 11:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-103917.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker",
          "vendor": "expresstech",
          "versions": [
            {
              "lessThanOrEqual": "11.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and imposes no meaningful obstacle to exploitation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:34.067Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/020209b3-2175-4509-836a-8a60ed4f4b15?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L536"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L2866"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/php/classes/class-qmn-quiz-manager.php#L517"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.7/renderer/frontend/class-qsm-new-renderer.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3729156%40quiz-master-next&new=3729156%40quiz-master-next"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T18:16:28.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103917",
    "datePublished": "2026-11-07T06:39:34.067Z",
    "dateReserved": "2026-10-01T14:18:28.822Z",
    "dateUpdated": "2026-11-07T06:39:34.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}