What is CVE-2026-14821?

CVE-2026-14821 is a low-severity vulnerability in Quiz And Survey Master (Qsm), classified under Missing Authorization. CVSS score: 2.7/10. Published 2026-07-28.

How severe is CVE-2026-14821?

Low severity. CVSS v3 base score is 2.7 out of 10.

Auth bypass in Quiz And Survey Master (Qsm)

CVE-2026-14821

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Quiz And Survey Master (Qsm) — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-14821?: CVE-2026-14821 is a low-severity vulnerability in Quiz And Survey Master (Qsm), classified under Missing Authorization. CVSS score: 2.7/10. Published 2026-07-28.
How severe is CVE-2026-14821?: Low severity. CVSS v3 base score is 2.7 out of 10.