EIP-2026-113994

This exploit demonstrates a CSRF/stored XSS vulnerability in Quiz And Survey Master (formerly Quiz Master Next) versions 4.5.4 and 4.7.8. The vulnerability allows unauthenticated attackers to inject malicious JavaScript via the question_name parameter, bypassing WordPress's esc_js() escaping due to improper handling in the admin_question.js file.