← back to popular plugins
wordfence / plugin · quiz-master-next

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

quiz-master-next
total installs
40,000
total vulns
33
critical
0
high
6
medium
27
low
0
latest vuln
—
patched
33
unpatched
0
avg time to patch
—
vulnerabilities (33)
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium ✓ patched
cve id CVE-2026-107862 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Oct 12, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 11.2.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
high ✓ patched
cve id CVE-2026-96558 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Oct 9, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail code branch that writes the unescaped payload to wp_mlw_qm_audit_trail.form_data.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium ✓ patched
cve id CVE-2026-104391 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Oct 7, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 11.2.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
high ✓ patched
cve id CVE-2026-104392 ↗
cvss score 7.5
cwe CWE-502: Deserialization of Untrusted Data
published Oct 7, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 11.2.7. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-97289 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Sep 30, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 11.2.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.5 - Unauthenticated Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-62140 ↗
cvss score 5.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Sep 10, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 11.2.5. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.4 - Authenticated (Contributor+) Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-79615 ↗
cvss score 4.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Aug 28, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 11.2.4. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-14825 ↗
cvss score 4.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Aug 17, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 11.2.3. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-14826 ↗
cvss score 4.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Aug 17, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 11.2.3. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
medium ✓ patched
cve id CVE-2026-15963 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Aug 15, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
medium ✓ patched
cve id CVE-2026-11780 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Aug 15, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz And Survey Master <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium ✓ patched
cve id CVE-2026-14824 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Jul 27, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection
medium ✓ patched
cve id CVE-2026-65454 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jul 22, 2026
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 11.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
medium ✓ patched
cve id CVE-2026-13767 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jul 15, 2026
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and above (who can own a quiz they are entitled to edit), to plant a SQL payload that is executed second-order whenever any user (including an administrator) views the quiz's Questions tab, allowing them to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz And Survey Master <= 11.1.4 - Missing Authorization
medium ✓ patched
cve id CVE-2026-14821 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Jul 7, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 11.1.4. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure
medium ✓ patched
cve id CVE-2026-9230 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Jul 2, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID to obtain a valid nonce bound to that quiz ID and their own user ID, then presents that nonce to the /quizzes/{id}/emails save endpoint, which accepts it without verifying quiz ownership.
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
medium ✓ patched
cve id CVE-2026-9233 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Jun 26, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
medium ✓ patched
cve id CVE-2026-6448 ↗
cvss score 4.9
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jun 5, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is exposed, this can be exploited by lower-privileged users.
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-48867 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Jun 3, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-40787 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Apr 23, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
medium ✓ patched
cve id CVE-2026-5797 ↗
cvss score 5.3
cwe CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
published Apr 16, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire results page output (including user answers), causing any injected shortcodes to be executed. This makes it possible for unauthenticated attackers to inject arbitrary WordPress shortcodes such as [qsm_result id=X] to access other users' quiz submissions without authorization, as the qsm_result shortcode lacks any authorization checks.
Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
medium ✓ patched
cve id CVE-2026-2412 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Mar 23, 2026
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization
medium ✓ patched
cve id CVE-2026-25329 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Feb 5, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-25324 ↗
cvss score 5.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Feb 1, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.3.4 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to [describe the impact of the vulnerability].
Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection
medium ✓ patched
cve id CVE-2025-67987 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jan 28, 2026
The Quiz And Survey Master plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz And Survey Master <= 10.3.3 - Missing Authorization
medium ✓ patched
cve id CVE-2026-24358 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Jan 8, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.3.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
medium ✓ patched
cve id CVE-2025-9637 ↗
cvss score 6.5
cwe CWE-862: Missing Authorization
published Jan 5, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.
Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter
medium ✓ patched
cve id CVE-2025-9318 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jan 5, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion
medium ✓ patched
cve id CVE-2025-9294 ↗
cvss score 4.3
cwe CWE-285: Improper Authorization
published Jan 5, 2026
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.
Quiz And Survey Master <= 10.3.2 - Missing Authorization
medium ✓ patched
cve id CVE-2025-63054 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Nov 30, 2025
The Quiz And Survey Master plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.3.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection
high ✓ patched
cve id CVE-2025-49401 ↗
cvss score 8.1
cwe CWE-502: Deserialization of Untrusted Data
published Sep 3, 2025
The Quiz And Survey Master plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 10.2.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection
medium ✓ patched
cve id CVE-2025-55708 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Aug 14, 2025
The Quiz And Survey Master plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 10.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation
medium ✓ patched
cve id CVE-2025-6790 ↗
cvss score 4.3
cwe CWE-352: Cross-Site Request Forgery (CSRF)
published Jul 24, 2025
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.2.2. This is due to missing or incorrect nonce validation on the qsm_insert_quiz_template_callback() function. This makes it possible for unauthenticated attackers to create templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.