Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
The Quiz and Survey Master - Security Vulnerability (CVE-2026-103917)
The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and…
PLUGIN
The Quiz and Survey Master
CVE-2026-103917
Risk Score
Threat Entry
Updated 2026-10-11
Quiz and Survey Master - Security Vulnerability (CVE-2026-96558)
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail…
PLUGIN
Quiz and Survey Master
CVE-2026-96558
Risk Score
Threat Entry
Updated 2026-10-07
Quiz And Survey Master - Security Vulnerability (CVE-2026-104391)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
PLUGIN
Quiz And Survey Master
CVE-2026-104391
Risk Score
Threat Entry
Updated 2026-10-09
Quiz And Survey Master - Security Vulnerability (CVE-2026-97289)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
PLUGIN
Quiz And Survey Master
CVE-2026-97289
Risk Score
Threat Entry
Updated 2026-08-28
Quiz and Survey Master - Security Vulnerability (CVE-2026-79615)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
PLUGIN
Quiz and Survey Master
CVE-2026-79615
Risk Score
Threat Entry
Updated 2026-08-26
Quiz and Survey Master - Security Vulnerability (CVE-2026-14826)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
PLUGIN
Quiz and Survey Master
CVE-2026-14826
Risk Score
Threat Entry
Updated 2026-08-26
Quiz and Survey Master - Security Vulnerability (CVE-2026-14825)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
PLUGIN
Quiz and Survey Master
CVE-2026-14825
Risk Score
Threat Entry
Updated 2026-08-20
Quiz And Survey Master - SQL Injection (CVE-2026-15963)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Quiz And Survey Master
CVE-2026-15963
Risk Score
Threat Entry
Updated 2026-08-20
Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2026-11780)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Quiz And Survey Master
CVE-2026-11780
Risk Score
Threat Entry
Updated 2026-08-26
Quiz and Survey Master - Security Vulnerability (CVE-2026-14824)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
PLUGIN
Quiz and Survey Master
CVE-2026-14824
Risk Score
Threat Entry
Updated 2026-07-28
Quiz and Survey Master - Broken Access Control (CVE-2026-14821)
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
PLUGIN
Quiz and Survey Master
CVE-2026-14821
Risk Score
Threat Entry
Updated 2026-07-27
Quiz and Survey Master - Security Vulnerability (CVE-2026-14820)
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
PLUGIN
Quiz and Survey Master
CVE-2026-14820
Risk Score
Threat Entry
Updated 2026-07-23
Quiz And Survey Master - SQL Injection (CVE-2026-65454)
Contributor SQL Injection in Quiz And Survey Master
PLUGIN
Quiz And Survey Master
CVE-2026-65454
Risk Score
Threat Entry
Updated 2026-07-06
Quiz and Survey Master - Broken Access Control (CVE-2026-9230)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID…
PLUGIN
Quiz and Survey Master
CVE-2026-9230
Risk Score
Threat Entry
Updated 2026-06-29
Quiz and Survey Master - Broken Access Control (CVE-2026-9233)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
PLUGIN
Quiz and Survey Master
CVE-2026-9233
Risk Score
Threat Entry
Updated 2026-06-17
Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2026-48867)
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master
PLUGIN
Quiz And Survey Master
CVE-2026-48867
Risk Score
Threat Entry
Updated 2026-06-17
Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2026-40787)
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master
PLUGIN
Quiz And Survey Master
CVE-2026-40787
Risk Score
Threat Entry
Updated 2026-07-23
Quiz And Survey Master - SQL Injection (CVE-2026-6448)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is…
PLUGIN
Quiz And Survey Master
CVE-2026-6448
Risk Score
Threat Entry
Updated 2026-06-17
Quiz And Survey Master - Security Vulnerability (CVE-2026-5797)
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire results page output (including user answers), causing any injected shortcodes to be executed. This makes it possible…
PLUGIN
Quiz And Survey Master
CVE-2026-5797
Risk Score
Threat Entry
Updated 2026-06-17
Quiz and Survey Master - SQL Injection (CVE-2026-2412)
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for…
PLUGIN
Quiz and Survey Master
CVE-2026-2412
Risk Score