Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · quiz-master-next
Quiz Master Next
73 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 19, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-111408 · affects up to 11.2.7 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Oct 12, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107862 · affects up to 11.2.7 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Oct 10, 2026Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: Stored DOM-Based Cross-Site ScriptingCVE-2026-96558 · affects up to 11.2.6 · reported by WordfenceHigh 7.2
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail code branch that writes the unescaped payload to wp_mlw_qm_audit_trail.form_data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-104392 · affects up to 11.2.7 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · affects up to 11.2.7 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · affects up to 11.2.6 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
Sep 11, 2026Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.CVE-2026-62140 · affects up to 11.2.5 · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
Aug 28, 2026Quiz and Survey Master (QSM): Does not check authorisationCVE-2026-79615 · fixed in 11.2.4 · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · fixed in 11.2.4 · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check before saving a quiz's front-end text settingsCVE-2026-14825 · fixed in 11.2.4 · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Aug 16, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Generic SQL InjectionCVE-2026-15963 · affects up to 11.2.1 · reported by WordfenceMedium 6.5
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Stored Cross-Site ScriptingCVE-2026-11780 · affects up to 11.2.1 · reported by WordfenceMedium 6.4
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 4, 2026Quiz and Survey Master (QSM): Does not properly escape a question setting before outputting it into an unquoted HTML attributeCVE-2026-14824 · fixed in 11.2.2 · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Jul 28, 2026Quiz and Survey Master (QSM): Does not perform a capability check before deleting output templatesCVE-2026-14821 · fixed in 11.1.5 · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · fixed in 11.1.3 · reported by WPScanMedium 5.3
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
Jul 23, 2026Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.CVE-2026-65454 · affects up to 11.2.0 · reported by PatchstackHigh 8.5
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
Jul 16, 2026Quiz Master Next: SQL InjectionCVE-2026-13767 · affects up to 11.2.0 · reported by WordfenceMedium 6.5
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and above (who can own a quiz they are entitled to edit), to plant a SQL payload that is executed second-order whenever any user (including an administrator) views the quiz's Questions tab, allowing them to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 3, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Authorization bypassCVE-2026-9230 · affects up to 11.1.4 · reported by WordfenceMedium 4.3
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID to obtain a valid nonce bound to that quiz ID and their own user ID, then presents that nonce to the /quizzes/{id}/emails save endpoint, which accepts it without verifying quiz ownership.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Authorization bypassCVE-2026-9233 · affects up to 11.1.4 · reported by WordfenceMedium 4.3
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · affects up to 11.1.2 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · affects up to 11.0.0 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
Jun 5, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based blind SQL InjectionCVE-2026-6448 · affects up to 11.1.2 · reported by WordfenceMedium 4.9
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is exposed, this can be exploited by lower-privileged users.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2026Quiz And Survey Master: Arbitrary Shortcode ExecutionCVE-2026-5797 · affects up to 11.1.0 · reported by WordfenceMedium 5.3
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire results page output (including user answers), causing any injected shortcodes to be executed. This makes it possible for unauthenticated attackers to inject arbitrary WordPress shortcodes such as [qsm_result id=X] to access other users' quiz submissions without authorization, as the qsm_result shortcode lacks any authorization checks.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 23, 2026Quiz and Survey Master (QSM): SQL InjectionCVE-2026-2412 · affects up to 10.3.5 · reported by WordfenceMedium 6.5
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67987 · affects up to 10.3.1 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.
Feb 19, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-25329 · affects up to 10.3.4 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
Feb 19, 2026Quiz And Survey Master: Authorization Bypass Through User-Controlled KeyCVE-2026-25324 · affects up to 10.3.4 · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
Jan 22, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-24358 · affects up to 10.3.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.
Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized access and modification of dataCVE-2025-9637 · affects up to 10.3.1 · reported by WordfenceMedium 6.5
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based SQL InjectionCVE-2025-9318 · affects up to 10.3.1 · reported by WordfenceMedium 6.5
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized loss of dataCVE-2025-9294 · affects up to 10.3.1 · reported by WordfenceMedium 4.3
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.
Dec 9, 2025Quiz And Survey Master: Missing AuthorizationCVE-2025-63054 · affects up to 10.3.2 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.2.
Aug 14, 2025Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-55708 · affects up to 10.2.4 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.2.4.
Aug 14, 2025Quiz and Survey Master (QSM): Does not have CSRF check in placeCVE-2025-6790 · fixed in 10.2.3 · reported by WPScanMedium 4.3
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · fixed in 9.2.1 · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Dec 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-37984 · affects up to 8.1.10 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.
Sep 23, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-8758 · fixed in 9.1.3 · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · fixed in 9.1.1 · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · fixed in 9.1.0 · reported by WPScanMedium 5.9
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · fixed in 9.0.5 · reported by WPScanMedium 5.4
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · fixed in 9.0.2 · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · fixed in 9.0.2 · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · affects up to 8.1.16 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
Jun 7, 2024Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: SQL InjectionCVE-2024-3592 · affects up to 9.0.1 · reported by WordfenceCritical 9.9
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-5606 appears to be a duplicate of this issue.
Apr 10, 2024Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27966 · affects up to 8.2.2 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.
Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · affects up to 8.1.4 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
Mar 15, 2024Quiz And Survey Master: Cross-Site Request Forgery (CSRF)CVE-2023-51521 · affects up to 8.1.18 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versioCVE-2023-47834 · affects up to 8.1.13 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versionCVE-2023-26524 · affects up to 8.0.10 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · fixed in 8.1.11 · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Jun 9, 2023Quiz And Survey Master: Cross-Site Request ForgeryCVE-2023-0292 · affects up to 8.0.8 · reported by WordfenceMedium 5.4
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Jun 9, 2023Quiz And Survey Master: Authorization bypassCVE-2023-0291 · affects up to 8.0.8 · reported by WordfenceHigh 7.2
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versionsCVE-2022-46862 · fixed in 8.0.8 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.
Nov 29, 2022Quiz and Survey Master: Input validation bypassCVE-2022-4033 · affects up to 8.0.4 · reported by WordfenceMedium 5.3
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
Nov 29, 2022Quiz and Survey Master: IFrame InjectionCVE-2022-4032 · affects up to 8.0.4 · reported by WordfenceHigh 7.2
The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.
Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · affects up to 7.3.10 · reported by PatchstackMedium 5.3
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Nov 18, 2022Auth.CVE-2022-40698 · affects up to 7.3.10 · reported by PatchstackMedium 5.4
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Nov 18, 2022Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-41652 · affects up to 7.3.10 · reported by PatchstackMedium 6.5
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Nov 17, 2022Multiple Auth.CVE-2021-36905 · affects up to 7.3.4 · reported by PatchstackMedium 5.4
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
Nov 3, 2022Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.CVE-2021-36906 · affects up to 7.3.6 · reported by PatchstackLow 2.7
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
Oct 28, 2022Auth.CVE-2021-36898 · affects up to 7.3.4 · reported by PatchstackHigh 7.5
Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
Oct 28, 2022Auth.CVE-2021-36864 · affects up to 7.3.4 · reported by PatchstackLow 3.4
Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
Oct 28, 2022Auth.CVE-2021-36863 · affects up to 7.3.4 · reported by PatchstackMedium 5.4
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
Sep 30, 2022ExpressTech Quiz And Survey Master plugin <= 7.3.4 at: Insecure direct object references (IDOR)CVE-2021-36865 · affects up to 7.3.4 · reported by PatchstackLow 3.8
Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · fixed in 7.3.7 · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · fixed in 7.3.7 · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · fixed in 7.3.7 · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · fixed in 7.3.2 · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Aug 18, 2021Quiz And Survey Master versions prior to 7.1.14: Cross-site scriptingCVE-2021-20792 · fixed in 7.1.14 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · fixed in 7.1.18 · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · fixed in 7.1.12 · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · fixed in 6.3.5 · reported by MITREMedium 6.1
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Mar 5, 2019The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-9575 · affects 6.0.4 to 6.0.4 · reported by MITREMedium 6.1
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.