Quiz Master Next Vulnerabilities

The Quiz And Survey Master plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 11.2.3. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized...

CVSS:

4.3

Affected:

up to 11.2.3

Fixed in:

11.2.4

Disclosed:

Aug 17, 2026

CVE-2026-14826 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 11.2.3. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized...

CVSS:

4.3

Affected:

up to 11.2.3

Fixed in:

11.2.4

Disclosed:

Aug 17, 2026

CVE-2026-14825 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVSS:

6.5

Affected:

up to 11.2.1

Fixed in:

11.2.2

Disclosed:

Aug 15, 2026

CVE-2026-15963 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 11.2.1

Fixed in:

11.2.2

Disclosed:

Aug 15, 2026

CVE-2026-11780 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 11.2.1

Fixed in:

11.2.2

Disclosed:

Jul 27, 2026

CVE-2026-14824 on NVD →

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 11.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

CVSS:

6.5

Affected:

up to 11.2.0

Fixed in:

11.2.1

Disclosed:

Jul 22, 2026

CVE-2026-65454 on NVD →

The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient p...

CVSS:

6.5

Affected:

up to 11.2.0

Fixed in:

11.2.1

Disclosed:

Jul 15, 2026

CVE-2026-13767 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 11.1.4. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 11.1.4

Fixed in:

11.1.5

Disclosed:

Jul 7, 2026

CVE-2026-14821 on NVD →

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to User Enumeration in all versions up to 11.1.3 (exclusive). This makes it possible for unauthenticated attackers to enumerate user data like usernames.

CVSS:

5.3

Affected:

up to 11.1.3

Fixed in:

11.1.3

Disclosed:

Jul 6, 2026

CVE-2026-14820 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVSS:

4.3

Affected:

up to 11.1.4

Fixed in:

11.1.5

Disclosed:

Jul 2, 2026

CVE-2026-9230 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVSS:

4.3

Affected:

up to 11.1.4

Fixed in:

11.1.5

Disclosed:

Jun 26, 2026

CVE-2026-9233 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL que...

CVSS:

4.9

Affected:

up to 11.1.2

Fixed in:

11.1.3

Disclosed:

Jun 5, 2026

CVE-2026-6448 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVSS:

7.2

Affected:

up to 11.1.2

Fixed in:

11.1.3

Disclosed:

Jun 3, 2026

CVE-2026-48867 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 11.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVSS:

7.2

Affected:

up to 11.0.0

Fixed in:

11.1.0

Disclosed:

Apr 23, 2026

CVE-2026-40787 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and html...

CVSS:

5.3

Affected:

up to 10.1.0

Fixed in:

11.1.1

Disclosed:

Apr 16, 2026

CVE-2026-5797 on NVD →

Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter vulnerability

CVSS:

8.5

Affected:

up to 10.3.5

Fixed in:

11.0.0

Disclosed:

Mar 24, 2026

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merge...

CVSS:

6.5

Affected:

up to 10.3.5

Fixed in:

11.0.0

Disclosed:

Mar 23, 2026

CVE-2026-2412 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.

Affected:

up to 10.3.1

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-67987 on NVD →

[en] Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.

Affected:

up to 10.3.4

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25324 on NVD →

[en] Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.

Affected:

up to 10.3.4

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25329 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 10.3.4

Fixed in:

10.3.5

Disclosed:

Feb 5, 2026

CVE-2026-25329 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.3.4 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to [describe the impact of the vulner...

CVSS:

5.3

Affected:

up to 10.3.4

Fixed in:

10.3.5

Disclosed:

Feb 1, 2026

CVE-2026-25324 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level acce...

CVSS:

6.5

Affected:

up to 10.3.1

Fixed in:

10.3.2

Disclosed:

Jan 28, 2026

CVE-2025-67987 on NVD →

[en] Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.

Affected:

up to 10.3.3

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2026-24358 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.3.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 10.3.3

Fixed in:

10.3.4

Disclosed:

Jan 8, 2026

CVE-2026-24358 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view...

CVSS:

6.5

Affected:

up to 10.3.1

Fixed in:

10.3.2

Disclosed:

Jan 5, 2026

CVE-2025-9637 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVSS:

6.5

Affected:

up to 10.3.1

Fixed in:

10.3.2

Disclosed:

Jan 5, 2026

CVE-2025-9318 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-le...

CVSS:

4.3

Affected:

up to 10.3.1

Fixed in:

10.3.2

Disclosed:

Jan 5, 2026

CVE-2025-9294 on NVD →

[en] Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.

Affected:

up to 10.3.1

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63054 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.3.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 10.3.2

Fixed in:

10.3.3

Disclosed:

Nov 30, 2025

CVE-2025-63054 on NVD →

[en] Deserialization of Untrusted Data vulnerability in ExpressTech Systems Quiz And Survey Master allows Object Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.5.

Affected:

up to 10.2.6

Fixed in:

10.2.6

Disclosed:

Sep 5, 2025

CVE-2025-49401 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 10.2.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is...

CVSS:

8.1

Affected:

up to 10.2.5

Fixed in:

10.2.6

Disclosed:

Sep 3, 2025

CVE-2025-49401 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 10.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level ac...

CVSS:

6.5

Affected:

up to 10.2.4

Fixed in:

10.2.5

Disclosed:

Aug 14, 2025

CVE-2025-55708 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master allows SQL Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.4.

Affected:

up to 10.2.5

Fixed in:

10.2.5

Disclosed:

Aug 14, 2025

CVE-2025-55708 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.2.2. This is due to missing or incorrect nonce validation on the qsm_insert_quiz_template_callback() function. This makes it possible for unauthenticate...

CVSS:

4.3

Affected:

up to 10.2.2

Fixed in:

10.2.3

Disclosed:

Jul 24, 2025

CVE-2025-6790 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 9.2.1

Fixed in:

9.2.1

Disclosed:

Mar 25, 2025

CVE-2024-10679 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrato...

CVSS:

4.4

Affected:

up to 9.2.0

Fixed in:

9.2.1

Disclosed:

Mar 11, 2025

CVE-2024-10679 on NVD →

[en] Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.

Affected:

up to 8.1.11

Fixed in:

8.1.11

Disclosed:

Dec 13, 2024

CVE-2023-37984 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 9.1.3

Fixed in:

9.1.3

Disclosed:

Sep 23, 2024

CVE-2024-8758 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrato...

CVSS:

4.4

Affected:

up to 9.1.2

Fixed in:

9.1.3

Disclosed:

Sep 2, 2024

CVE-2024-8758 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.

Affected:

up to 9.1.1

Fixed in:

9.1.1

Disclosed:

Aug 26, 2024

CVE-2024-6879 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirect URL in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributo...

CVSS:

6.4

Affected:

up to 9.1.0

Fixed in:

9.1.1

Disclosed:

Aug 5, 2024

CVE-2024-6879 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

Affected:

up to 9.1.0

Fixed in:

9.1.0

Disclosed:

Aug 3, 2024

CVE-2024-6390 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz retake button label in all versions up to, and including, 9.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVSS:

6.4

Affected:

up to 9.0.5

Fixed in:

9.1.0

Disclosed:

Jul 13, 2024

CVE-2024-6390 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks

Affected:

up to 9.0.5

Fixed in:

9.0.5

Disclosed:

Jul 11, 2024

CVE-2024-6025 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role

Affected:

up to 9.0.2

Fixed in:

9.0.2

Disclosed:

Jul 2, 2024

CVE-2024-5606 on NVD →

[en] The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 9.0.2

Fixed in:

9.0.2

Disclosed:

Jul 1, 2024

CVE-2024-4934 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 9.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 9.0.4

Fixed in:

9.0.5

Disclosed:

Jun 20, 2024

CVE-2024-6025 on NVD →

[en] Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.

Affected:

up to 8.1.17

Fixed in:

8.1.17

Disclosed:

Jun 14, 2024

CVE-2023-51507 on NVD →

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via quiz fields in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVSS:

6.4

Affected:

up to 9.0.1

Fixed in:

9.0.2

Disclosed:

Jun 10, 2024

CVE-2024-4934 on NVD →

[en] The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

Affected:

up to 9.0.2

Fixed in:

9.0.2

Disclosed:

Jun 7, 2024

CVE-2024-3592 on NVD →

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVSS:

9.9

Affected:

up to 9.0.1

Fixed in:

9.0.2

Disclosed:

Jun 6, 2024

CVE-2024-3592 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.

Affected:

up to 8.1.5

Fixed in:

8.1.5

Disclosed:

Mar 26, 2024

CVE-2023-28787 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.

Affected:

up to 8.2.3

Fixed in:

8.2.3

Disclosed:

Mar 21, 2024

CVE-2024-27966 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.

Affected:

up to 8.1.19

Fixed in:

8.1.19

Disclosed:

Mar 16, 2024

CVE-2023-51521 on NVD →

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVSS:

4.4

Affected:

up to 8.2.2

Fixed in:

8.2.3

Disclosed:

Mar 13, 2024

CVE-2024-27966 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on one of its functions in versions up to, and including, 8.1.16. This makes it possible for unauthenticated attackers to invoke this function.

CVSS:

5.3

Affected:

up to 8.1.16

Fixed in:

8.1.17

Disclosed:

Dec 27, 2023

CVE-2023-51507 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.18. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete quiz results and perform other actions via a for...

CVSS:

4.3

Affected:

up to 8.1.18

Fixed in:

8.1.19

Disclosed:

Dec 27, 2023

CVE-2023-51521 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

Affected:

up to 8.1.14

Fixed in:

8.1.14

Disclosed:

Nov 22, 2023

CVE-2023-47834 on NVD →

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 8.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVSS:

6.4

Affected:

up to 8.1.13

Fixed in:

8.1.14

Disclosed:

Nov 16, 2023

CVE-2023-47834 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.

Affected:

up to 8.1.0

Fixed in:

8.1.0

Disclosed:

Nov 12, 2023

CVE-2023-26524 on NVD →

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.1.18. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to...

Affected:

up to 8.1.19

Fixed in:

8.1.19

Disclosed:

Nov 8, 2023

No patched version available. Unknown discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Quiz And Survey Master Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not be...

Affected:

up to 8.1.16

Fixed in:

8.1.16

Disclosed:

Sep 13, 2023

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.15. This is due to missing or incorrect nonce validation on the 'display_results' function. This makes it possible for unauthenticated attackers to submit quizzes on behalf of another user v...

CVSS:

4.3

Affected:

up to 8.1.15

Fixed in:

8.1.16

Disclosed:

Sep 12, 2023

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.15. This is due to missing or incorrect nonce validation on the 'display_results' function. This makes it possible for unauthenticated attackers to submit quizzes on behalf of another user v...

Affected:

up to 8.1.16

Fixed in:

8.1.16

Disclosed:

Sep 12, 2023

[en] The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 8.1.11

Fixed in:

8.1.11

Disclosed:

Aug 7, 2023

CVE-2023-3575 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a question title in versions up to, and including 8.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arb...

CVSS:

6.4

Affected:

up to 8.1.10

Fixed in:

8.1.11

Disclosed:

Jul 17, 2023

CVE-2023-3575 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to exessive quiz attempts due to a missing validation checks on the ajax_submit_results() function in versions up to, and including, 8.1.10. This makes it possible for unauthenticated attackers to bypass the set limits for the number of times a user can atte...

CVSS:

5.3

Affected:

up to 8.1.10

Fixed in:

8.1.11

Disclosed:

Jul 17, 2023

CVE-2023-37984 on NVD →

[en] The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete ar...

Affected:

up to 8.0.9

Fixed in:

8.0.9

Disclosed:

Jun 9, 2023

CVE-2023-0292 on NVD →

[en] The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

Affected:

up to 8.0.9

Fixed in:

8.0.9

Disclosed:

Jun 9, 2023

CVE-2023-0291 on NVD →

The Quiz and Survey Master plugin for WordPress is vulnerable to SQL Injection via the 'question_ids_[XX]' cookie in versions up to, and including, 8.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

CVSS:

9.8

Affected:

up to 8.1.4

Fixed in:

8.1.5

Disclosed:

Apr 16, 2023

CVE-2023-28787 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.10. This is due to missing or incorrect nonce validation on the qsm_restore_function function. This makes it possible for unauthenticated attackers to restore deleted quizzes via a forged re...

CVSS:

4.3

Affected:

up to 8.0.10

Fixed in:

8.1.0

Disclosed:

Feb 28, 2023

CVE-2023-26524 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.10. This is due to missing or incorrect nonce validation on the qsm_restore_function function. This makes it possible for unauthenticated attackers to restore deleted quizzes via a forged re...

Affected:

up to 8.1.0

Fixed in:

8.1.0

Disclosed:

Feb 28, 2023

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

CVSS:

7.2

Affected:

up to 8.0.8

Fixed in:

8.0.9

Disclosed:

Feb 15, 2023

CVE-2023-0291 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.

Affected:

up to 8.0.8

Fixed in:

8.0.8

Disclosed:

Feb 14, 2023

CVE-2022-46862 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitra...

CVSS:

5.4

Affected:

up to 8.0.8

Fixed in:

8.0.9

Disclosed:

Feb 8, 2023

CVE-2023-0292 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.7. This is due to missing or incorrect nonce validation on the qsm_update_text_message function. This makes it possible for unauthenticated attackers to invoke this function leading to quiz...

CVSS:

4.3

Affected:

up to 8.0.7

Fixed in:

8.0.8

Disclosed:

Dec 16, 2022

CVE-2022-46862 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.7. This is due to missing or incorrect nonce validation on the qsm_update_text_message function. This makes it possible for unauthenticated attackers to invoke this function leading to quiz...

Affected:

up to 8.0.8

Fixed in:

8.0.8

Disclosed:

Dec 16, 2022

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iF...

CVSS:

7.2

Affected:

up to 8.0.4

Fixed in:

8.0.5

Disclosed:

Nov 29, 2022

CVE-2022-4032 on NVD →

[en] The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inje...

Affected:

up to 8.0.5

Fixed in:

8.0.5

Disclosed:

Nov 29, 2022

CVE-2022-4032 on NVD →

[en] The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes...

Affected:

up to 8.0.5

Fixed in:

8.0.5

Disclosed:

Nov 29, 2022

CVE-2022-4033 on NVD →

[en] Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Affected:

up to 7.3.11

Fixed in:

7.3.11

Disclosed:

Nov 18, 2022

CVE-2022-41652 on NVD →

[en] Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Affected:

up to 7.3.11

Fixed in:

7.3.11

Disclosed:

Nov 18, 2022

CVE-2022-42883 on NVD →

[en] Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Affected:

up to 7.3.11

Fixed in:

7.3.11

Disclosed:

Nov 18, 2022

CVE-2022-40698 on NVD →

[en] Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

Affected:

up to 8.0.5

Fixed in:

8.0.5

Disclosed:

Nov 17, 2022

CVE-2021-36905 on NVD →

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it p...

CVSS:

5.3

Affected:

up to 8.0.4

Fixed in:

8.0.5

Disclosed:

Nov 16, 2022

CVE-2022-4033 on NVD →

[en] Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.

Affected:

up to 7.3.7

Fixed in:

7.3.7

Disclosed:

Nov 3, 2022

CVE-2021-36906 on NVD →

[en] Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Oct 28, 2022

CVE-2021-36864 on NVD →

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Oct 28, 2022

CVE-2021-36863 on NVD →

[en] Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Oct 28, 2022

CVE-2021-36898 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.3.10. This is due to missing or incorrect nonce validation on several of its functions. This makes it possible for unauthenticated attackers to clear audit data and perform other actions, via...

CVSS:

8.8

Affected:

up to 7.3.10

Fixed in:

7.3.11

Disclosed:

Oct 23, 2022

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.3.10. This is due to missing or incorrect nonce validation on several of its functions. This makes it possible for unauthenticated attackers to clear audit data and perform other actions, via...

Affected:

up to 7.3.11

Fixed in:

7.3.11

Disclosed:

Oct 23, 2022

The Quiz And Survey Master plugin for WordPress is vulnerable to SQL Injection via several parameters in versions up to, and including, 7.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...

CVSS:

7.2

Affected:

up to 7.3.4

Fixed in:

7.3.5

Disclosed:

Oct 21, 2022

CVE-2021-36898 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.3.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scrip...

CVSS:

7.2

Affected:

up to 7.3.10

Fixed in:

7.3.11

Disclosed:

Oct 21, 2022

CVE-2022-40698 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 7.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inj...

CVSS:

6.4

Affected:

up to 7.3.4

Fixed in:

7.3.5

Disclosed:

Oct 21, 2022

CVE-2021-36905 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 7.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inj...

CVSS:

6.4

Affected:

up to 7.3.4

Fixed in:

7.3.5

Disclosed:

Oct 21, 2022

CVE-2021-36863 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 7.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex...

CVSS:

6.1

Affected:

up to 7.3.4

Fixed in:

7.3.5

Disclosed:

Oct 21, 2022

CVE-2021-36864 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 7.3.6. This is due to insufficient validation on a user controlled key. This makes it possible for authenticated attackers with author-level capabilities and above to reset and delete quiz...

CVSS:

5.4

Affected:

up to 7.3.6

Fixed in:

7.3.7

Disclosed:

Oct 21, 2022

CVE-2021-36906 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 7.3.10. This could allow unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 7.3.10

Fixed in:

7.3.11

Disclosed:

Oct 21, 2022

CVE-2022-42883 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to authorization bypass due to a missing user validations on the qsm_clear_audit_data function in versions up to, and including, 7.3.10. This makes it possible for unauthenticated attackers to invoke this function and clear audit log data.

CVSS:

4.3

Affected:

up to 7.3.10

Fixed in:

7.3.11

Disclosed:

Oct 21, 2022

CVE-2022-41652 on NVD →

[en] Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Sep 30, 2022

CVE-2021-36865 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 7.3.4. This is due to insufficient validation on the key controlling a quiz's id. This makes it possible for authenticated attackers with author-level capabilities and above to change arbi...

CVSS:

5.4

Affected:

up to 7.3.4

Fixed in:

7.3.5

Disclosed:

Sep 29, 2022

CVE-2021-36865 on NVD →

[en] Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.

Affected:

up to 7.3.7

Fixed in:

7.3.7

Disclosed:

Jan 17, 2022

CVE-2022-0180 on NVD →

[en] Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.

Affected:

up to 7.3.7

Fixed in:

7.3.7

Disclosed:

Jan 17, 2022

CVE-2022-0181 on NVD →

[en] Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.

Affected:

up to 7.3.7

Fixed in:

7.3.7

Disclosed:

Jan 17, 2022

CVE-2022-0182 on NVD →

Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.

CVSS:

8.8

Affected:

up to 7.3.5

Fixed in:

7.3.7

Disclosed:

Jan 12, 2022

CVE-2022-0180 on NVD →

Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.

CVSS:

5.4

Affected:

up to 7.3.6

Fixed in:

7.3.7

Disclosed:

Jan 12, 2022

CVE-2022-0182 on NVD →

Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.

CVSS:

5.4

Affected:

up to 7.3.6

Fixed in:

7.3.7

Disclosed:

Jan 12, 2022

CVE-2022-0181 on NVD →

[en] The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected:

up to 7.3.2

Fixed in:

7.3.2

Disclosed:

Oct 11, 2021

CVE-2021-24691 on NVD →

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

CVSS:

6.1

Affected:

up to 7.1.13

Fixed in:

7.1.14

Disclosed:

Sep 13, 2021

CVE-2021-20792 on NVD →

The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS:

4.8

Affected:

up to 7.3.1

Fixed in:

7.3.2

Disclosed:

Sep 13, 2021

CVE-2021-24691 on NVD →

[en] Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

Affected:

up to 7.1.14

Fixed in:

7.1.14

Disclosed:

Aug 18, 2021

CVE-2021-20792 on NVD →

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

CVSS:

6.1

Affected:

up to 7.1.13

Fixed in:

7.1.14

Disclosed:

Aug 10, 2021

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

Affected:

up to 7.1.14

Fixed in:

7.1.14

Disclosed:

Aug 10, 2021

[en] The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin t...

Affected:

up to 7.1.18

Fixed in:

7.1.18

Disclosed:

Jun 20, 2021

CVE-2021-24368 on NVD →

The Quiz And Survey Master plugin plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 7.1.18 due to insufficient input sanitization and output escaping on the IP value. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.4

Affected:

up to 7.1.19

Fixed in:

7.1.19

Disclosed:

Jun 3, 2021

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to ope...

CVSS:

6.1

Affected:

up to 7.1.17

Fixed in:

7.1.18

Disclosed:

Jun 3, 2021

CVE-2021-24368 on NVD →

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Quiz And Survey Master plugin (versions <= 7.1.18).

Affected:

up to 7.1.19

Fixed in:

7.1.19

Disclosed:

Jun 3, 2021

The Quiz And Survey Master plugin plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 7.1.18 due to insufficient input sanitization and output escaping on the IP value. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 7.1.19

Fixed in:

7.1.19

Disclosed:

Jun 3, 2021

[en] The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shor...

Affected:

up to 7.1.12

Fixed in:

7.1.12

Disclosed:

Apr 12, 2021

CVE-2021-24221 on NVD →

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode...

CVSS:

8.8

Affected:

up to 7.1.11

Fixed in:

7.1.12

Disclosed:

Mar 26, 2021

CVE-2021-24221 on NVD →

Authenticated SQL injection (SQLi) vulnerability discovered by WPScan Team in WordPress Quiz And Survey Master plugin (versions <= 7.1.13).

Affected:

up to 7.1.14

Fixed in:

7.1.14

Disclosed:

Mar 26, 2021

[en] An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the uploa...

Affected:

up to 7.0.1

Fixed in:

7.0.1

Disclosed:

Jan 1, 2021

CVE-2020-35949 on NVD →

[en] An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_f...

Affected:

up to 7.0.1

Fixed in:

7.0.1

Disclosed:

Jan 1, 2021

CVE-2020-35951 on NVD →

The Quiz and Survey Master plugin for WordPress is vulnerable to arbitrary file uploads due to missing filename sanitization in the qsm_upload_image_fd_question() function in versions up to, and including, 7.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server...

CVSS:

9.8

Affected:

up to 7.0.1

Fixed in:

7.0.2

Disclosed:

Aug 29, 2020

Unauthenticated Arbitrary File Upload vulnerability found by NinTechNet in WordPress Quiz And Survey Master plugin (versions <= 7.0.1).

Affected:

up to 7.0.2

Fixed in:

7.0.2

Disclosed:

Aug 29, 2020

The Quiz and Survey Master plugin for WordPress is vulnerable to arbitrary file uploads due to missing filename sanitization in the qsm_upload_image_fd_question() function in versions up to, and including, 7.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server...

Affected:

up to 7.0.2

Fixed in:

7.0.2

Disclosed:

Aug 29, 2020

[en] php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

Affected:

up to 4.7.9

Fixed in:

4.7.9

Disclosed:

Aug 16, 2020

CVE-2016-11085 on NVD →

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, an...

CVSS:

9.8

Affected:

up to 7.0.1

Fixed in:

7.0.1

Disclosed:

Aug 3, 2020

CVE-2020-35949 on NVD →

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_f...

CVSS:

8.2

Affected:

up to 7.0.1

Fixed in:

7.0.1

Disclosed:

Aug 3, 2020

CVE-2020-35951 on NVD →

The Quiz and Survery Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the text editor and correct answer parameters in versions up to, and including, 6.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web...

CVSS:

6.4

Affected:

up to 6.4.12

Fixed in:

7.0.0

Disclosed:

Jul 29, 2020

The Quiz and Survery Master plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the text editor and correct answer parameters in versions up to, and including, 6.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web...

Affected:

up to 7.0.0

Fixed in:

7.0.0

Disclosed:

Jul 29, 2020

[en] The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.ph...

Affected:

up to 6.3.5

Fixed in:

6.3.5

Disclosed:

Dec 13, 2019

CVE-2019-17599 on NVD →

The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. Th...

CVSS:

6.1

Affected:

up to 6.3.4

Fixed in:

6.3.5

Disclosed:

Nov 13, 2019

CVE-2019-17599 on NVD →

The Quiz And Survey Master plugin 6.2.1 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.

CVSS:

6.1

Affected:

up to 6.2.1

Fixed in:

6.2.2

Disclosed:

Mar 5, 2019

CVE-2019-9575 on NVD →

[en] The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.

Affected:

up to 6.2.2

Fixed in:

6.2.2

Disclosed:

Mar 5, 2019

CVE-2019-9575 on NVD →

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7.8. This is due to missing or incorrect nonce validation in the php/qmn_options_questions_tab.php file. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

8.8

Affected:

up to 4.7.9

Fixed in:

4.7.9

Disclosed:

Dec 15, 2016

CVE-2016-11085 on NVD →

This plugin is prone to a stored cross site scripting and cross site request forgery vulnerabilities. Update the plugin.

Affected:

up to 4.7.9

Fixed in:

4.7.9

Disclosed:

Dec 15, 2016

The Quiz And Survey Master plugin for WordPress is vulnerable to Multiple SQL Injections via several parameters in versions before 4.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers of low-pri...

CVSS:

8.8

Affected:

up to 4.4.4

Fixed in:

4.4.4

Disclosed:

Jul 16, 2015

Because of this vulnerability, authenticated users can execute arbitrary SQL commands. Update the plugin.

Affected:

up to 4.4.4

Fixed in:

4.4.4

Disclosed:

Jul 16, 2015

The Quiz And Survey Master plugin for WordPress is vulnerable to Multiple SQL Injections via several parameters in versions before 4.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers of low-pri...

Affected:

up to 4.4.4

Fixed in:

4.4.4

Disclosed:

Jul 16, 2015

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 8.0.5). Luca Greeb discovered and reported this Other Vulnerability Type vulnerability in WordPress Quiz And Survey Master Plugin. This vulnerability has been fixed in version 8.0.5.

Affected:

up to 8.0.5

Fixed in:

8.0.5

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 8.0.5). Luca Greeb discovered and reported this Other Vulnerability Type vulnerability in WordPress Quiz And Survey Master Plugin. This vulnerability has been fixed in version 8.0.5.

Affected:

up to 8.0.5

Fixed in:

8.0.5

When the &quot;Disable collecting and storing IP addresses?&quot; setting is not used, the plugin retrieves the IP address of the submitting user via various methods, such as $_SERVER[&#039;REMOTE_ADDR&#039;] but also arbitrary headers which can be tampered with. The final IP is not sanitised or validated, before being...

Affected:

up to 7.1.19

Fixed in:

7.1.19

While confirming https://wpscan.com/vulnerability/3b52b25c-82a1-41c7-83ac-92e244f7c5ab, another SQLi issue was identified and reported. The qsm_rest_get_bank_questions() function in the php/rest-api.php file did not property sanitise and escape the category parameter before using it in SQL statements passed to the get_...

Affected:

up to 7.1.14

Fixed in:

7.1.14

Because the plugin doesn&#039;t validate the name of the uploaded file, an unauthenticated user could upload a PHP script with a double extension, e.g., script.php.jpg, and execute it on HTTP servers running a configuration such as Apache + PHP FastCGI. Edit (WPScanTeam): This appears to be due to an incomplete fi...

Affected:

up to 7.0.2

Fixed in:

7.0.2

A stored cross-site scripting vulnerability exists in Quiz and Survey Master plugin (version 6.4.12 &amp; below). The vulnerability exists in quiz creation module where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient...

Affected:

up to 7.0.0

Fixed in:

7.0.0

The Quiz And Survey Master &ndash; Best Quiz, Exam and Survey Plugin for WordPress WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.

Affected:

up to 4.4.4

Fixed in:

4.4.4

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.15. This is due to missing or incorrect nonce validation on the &#039;display_results&#039; function. This makes it possible for unauthenticated attackers to submit quizzes on behalf of anot...

Affected:

up to 8.1.16

Fixed in:

8.1.16

The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.1.18. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to show disabled contact fields and delete quiz results via a forged request granted they...

Affected:

up to 8.1.19

Fixed in:

8.1.19

Affected:

up to 10.2.3

Fixed in:

10.2.3

CVE-2025-6790 on NVD →