PULSEUnderground Intel

LIVE54signals / 24h

FEED

ransomrhysida reclama a Law Offices of R. David Williams, P.A. · US · Professional Servicesransomulose reclama a www.newyjh.com · KR · Not Foundransomstorm reclama a West County Health Centers · US · Healthcareransomstorm reclama a Gardeners' Guild · US · Agriculture and Food Productionransomthegentlemen reclama a LegalWise · ZA · Professional Servicesransomthegentlemen reclama a Samwumed · KR · Healthcareransomthegentlemen reclama a Edcon · ZA · Manufacturingransomthegentlemen reclama a Defencebit · GB · Government & Defenseransomthegentlemen reclama a Datacomm Services · US · Technologyransomthegentlemen reclama a Webb Electric Company of Florida · US · Energy & Utilitiesransomthegentlemen reclama a Solaria · ID · Energy & Utilitiesransomthegentlemen reclama a Auren · ES · Professional Servicesransomthegentlemen reclama a QUALITY SPORT Topsport Italia · IT · Retail & E-Commerceransomthegentlemen reclama a Europrim · FR · Healthcareransomrhysida reclama a Law Offices of R. David Williams, P.A. · US · Professional Servicesransomulose reclama a www.newyjh.com · KR · Not Foundransomstorm reclama a West County Health Centers · US · Healthcareransomstorm reclama a Gardeners' Guild · US · Agriculture and Food Productionransomthegentlemen reclama a LegalWise · ZA · Professional Servicesransomthegentlemen reclama a Samwumed · KR · Healthcareransomthegentlemen reclama a Edcon · ZA · Manufacturingransomthegentlemen reclama a Defencebit · GB · Government & Defenseransomthegentlemen reclama a Datacomm Services · US · Technologyransomthegentlemen reclama a Webb Electric Company of Florida · US · Energy & Utilitiesransomthegentlemen reclama a Solaria · ID · Energy & Utilitiesransomthegentlemen reclama a Auren · ES · Professional Servicesransomthegentlemen reclama a QUALITY SPORT Topsport Italia · IT · Retail & E-Commerceransomthegentlemen reclama a Europrim · FR · Healthcare

CVE WatchSep 30, 2026

CVE-2026-97289

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions.

CVSS

7.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 30, 2026 · Last modified: Sep 30, 2026 · CWE-79

EPSS · 30d

Not enough EPSS history yet.

Technical description

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-973016.5 MED

———Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.1h CVE-2026-972986.5 MED

———Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.1h CVE-2026-972926.5 MED

———Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.1h CVE-2026-972886.5 MED

———Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.1h CVE-2026-972866.5 MED

———Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions.1h CVE-2026-972796.5 MED

———Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.1h