Is Quiz and Survey Master (QSM) safe?

Every recorded flaw

• Oct 19, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-111408 · affects up to 11.2.7 · reported by PatchstackHigh 8.8
• Oct 12, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107862 · affects up to 11.2.7 · reported by PatchstackMedium 6.5
• Oct 10, 2026Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: Stored DOM-Based Cross-Site ScriptingCVE-2026-96558 · affects up to 11.2.6 · reported by WordfenceHigh 7.2
• Oct 9, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-104392 · affects up to 11.2.7 · reported by PatchstackHigh 8.8
• Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · affects up to 11.2.7 · reported by PatchstackMedium 6.5
• Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · affects up to 11.2.6 · reported by PatchstackHigh 7.1
• Sep 11, 2026Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.CVE-2026-62140 · affects up to 11.2.5 · reported by PatchstackMedium 5.3
• Aug 28, 2026Quiz and Survey Master (QSM): Does not check authorisationCVE-2026-79615 · fixed in 11.2.4 · reported by WPScanLow 2.7
• Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · fixed in 11.2.4 · reported by WPScanLow 2.7
• Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check before saving a quiz's front-end text settingsCVE-2026-14825 · fixed in 11.2.4 · reported by WPScanLow 2.7
• Aug 16, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Generic SQL InjectionCVE-2026-15963 · affects up to 11.2.1 · reported by WordfenceMedium 6.5
• Aug 16, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Stored Cross-Site ScriptingCVE-2026-11780 · affects up to 11.2.1 · reported by WordfenceMedium 6.4
• Aug 4, 2026Quiz and Survey Master (QSM): Does not properly escape a question setting before outputting it into an unquoted HTML attributeCVE-2026-14824 · fixed in 11.2.2 · reported by WPScanMedium 4.8
• Jul 28, 2026Quiz and Survey Master (QSM): Does not perform a capability check before deleting output templatesCVE-2026-14821 · fixed in 11.1.5 · reported by WPScanLow 2.7
• Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · fixed in 11.1.3 · reported by WPScanMedium 5.3
• Jul 23, 2026Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.CVE-2026-65454 · affects up to 11.2.0 · reported by PatchstackHigh 8.5
• Jul 16, 2026Quiz Master Next: SQL InjectionCVE-2026-13767 · affects up to 11.2.0 · reported by WordfenceMedium 6.5
• Jul 3, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Authorization bypassCVE-2026-9230 · affects up to 11.1.4 · reported by WordfenceMedium 4.3
• Jun 27, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Authorization bypassCVE-2026-9233 · affects up to 11.1.4 · reported by WordfenceMedium 4.3
• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · affects up to 11.1.2 · reported by PatchstackHigh 7.1
• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · affects up to 11.0.0 · reported by PatchstackHigh 7.1
• Jun 5, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based blind SQL InjectionCVE-2026-6448 · affects up to 11.1.2 · reported by WordfenceMedium 4.9
• Apr 17, 2026Quiz And Survey Master: Arbitrary Shortcode ExecutionCVE-2026-5797 · affects up to 11.1.0 · reported by WordfenceMedium 5.3
• Mar 23, 2026Quiz and Survey Master (QSM): SQL InjectionCVE-2026-2412 · affects up to 10.3.5 · reported by WordfenceMedium 6.5
• Feb 20, 2026Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67987 · affects up to 10.3.1 · reported by PatchstackHigh 8.5
• Feb 19, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-25329 · affects up to 10.3.4 · reported by PatchstackMedium 4.3
• Feb 19, 2026Quiz And Survey Master: Authorization Bypass Through User-Controlled KeyCVE-2026-25324 · affects up to 10.3.4 · reported by PatchstackMedium 5.3
• Jan 22, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-24358 · affects up to 10.3.3 · reported by PatchstackMedium 4.3
• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized access and modification of dataCVE-2025-9637 · affects up to 10.3.1 · reported by WordfenceMedium 6.5
• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based SQL InjectionCVE-2025-9318 · affects up to 10.3.1 · reported by WordfenceMedium 6.5
• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized loss of dataCVE-2025-9294 · affects up to 10.3.1 · reported by WordfenceMedium 4.3
• Dec 9, 2025Quiz And Survey Master: Missing AuthorizationCVE-2025-63054 · affects up to 10.3.2 · reported by PatchstackMedium 5.3
• Aug 14, 2025Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-55708 · affects up to 10.2.4 · reported by PatchstackHigh 8.5
• Aug 14, 2025Quiz and Survey Master (QSM): Does not have CSRF check in placeCVE-2025-6790 · fixed in 10.2.3 · reported by WPScanMedium 4.3
• Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · fixed in 9.2.1 · reported by WPScanMedium 6.1
• Dec 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-37984 · affects up to 8.1.10 · reported by PatchstackMedium 4.3
• Sep 23, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-8758 · fixed in 9.1.3 · reported by WPScanMedium 4.8
• Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · fixed in 9.1.1 · reported by WPScanMedium 4.7
• Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · fixed in 9.1.0 · reported by WPScanMedium 5.9
• Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · fixed in 9.0.5 · reported by WPScanMedium 5.4
• Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · fixed in 9.0.2 · reported by WPScanHigh 8.8
• Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · fixed in 9.0.2 · reported by WPScanMedium 5.5
• Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · affects up to 8.1.16 · reported by PatchstackMedium 5.3
• Jun 7, 2024Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: SQL InjectionCVE-2024-3592 · affects up to 9.0.1 · reported by WordfenceCritical 9.9
• Apr 10, 2024Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27966 · affects up to 8.2.2 · reported by PatchstackMedium 5.9
• Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · affects up to 8.1.4 · reported by Patchstack2.0% oddsCritical 9.3
• Mar 15, 2024Quiz And Survey Master: Cross-Site Request Forgery (CSRF)CVE-2023-51521 · affects up to 8.1.18 · reported by PatchstackMedium 5.4
• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versioCVE-2023-47834 · affects up to 8.1.13 · reported by PatchstackMedium 6.5
• Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versionCVE-2023-26524 · affects up to 8.0.10 · reported by PatchstackMedium 4.3
• Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · fixed in 8.1.11 · reported by WPScanMedium 5.4
• Jun 9, 2023Quiz And Survey Master: Cross-Site Request ForgeryCVE-2023-0292 · affects up to 8.0.8 · reported by WordfenceMedium 5.4
• Jun 9, 2023Quiz And Survey Master: Authorization bypassCVE-2023-0291 · affects up to 8.0.8 · reported by Wordfence2.0% oddsHigh 7.2
• Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versionsCVE-2022-46862 · fixed in 8.0.8 · reported by PatchstackMedium 4.3
• Nov 29, 2022Quiz and Survey Master: Input validation bypassCVE-2022-4033 · affects up to 8.0.4 · reported by WordfenceMedium 5.3
• Nov 29, 2022Quiz and Survey Master: IFrame InjectionCVE-2022-4032 · affects up to 8.0.4 · reported by WordfenceHigh 7.2
• Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · affects up to 7.3.10 · reported by PatchstackMedium 5.3
• Nov 18, 2022Auth.CVE-2022-40698 · affects up to 7.3.10 · reported by PatchstackMedium 5.4
• Nov 18, 2022Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-41652 · affects up to 7.3.10 · reported by PatchstackMedium 6.5
• Nov 17, 2022Multiple Auth.CVE-2021-36905 · affects up to 7.3.4 · reported by PatchstackMedium 5.4
• Nov 3, 2022Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.CVE-2021-36906 · affects up to 7.3.6 · reported by PatchstackLow 2.7
• Oct 28, 2022Auth.CVE-2021-36898 · affects up to 7.3.4 · reported by Patchstack1.1% oddsHigh 7.5
• Oct 28, 2022Auth.CVE-2021-36864 · affects up to 7.3.4 · reported by PatchstackLow 3.4
• Oct 28, 2022Auth.CVE-2021-36863 · affects up to 7.3.4 · reported by PatchstackMedium 5.4
• Sep 30, 2022ExpressTech Quiz And Survey Master plugin <= 7.3.4 at: Insecure direct object references (IDOR)CVE-2021-36865 · affects up to 7.3.4 · reported by PatchstackLow 3.8
• Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · fixed in 7.3.7 · reported by vultures@jpcert.or.jpMedium 5.4
• Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · fixed in 7.3.7 · reported by vultures@jpcert.or.jp1.3% oddsMedium 6.1
• Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · fixed in 7.3.7 · reported by vultures@jpcert.or.jpHigh 8.8
• Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · fixed in 7.3.2 · reported by WPScanMedium 4.8
• Aug 18, 2021Quiz And Survey Master versions prior to 7.1.14: Cross-site scriptingCVE-2021-20792 · fixed in 7.1.14 · reported by vultures@jpcert.or.jp2.9% oddsMedium 6.1
• Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · fixed in 7.1.18 · reported by WPScanMedium 6.1
• Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · fixed in 7.1.12 · reported by WPScan1.9% oddsHigh 8.8
• Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · fixed in 6.3.5 · reported by MITRE1.7% oddsMedium 6.1
• Mar 5, 2019The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-9575 · affects 6.0.4 to 6.0.4 · reported by MITRE1.6% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.