Threat Database (62)

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Security Vulnerability (CVE-2022-4033)

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.

PLUGIN Quiz And Survey Master

CVE-2022-4033

MEDIUM CVSS 5.3 2022-11-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Information Disclosure (CVE-2022-42883)

Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2022-42883

MEDIUM CVSS 5.3 2022-11-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2022-40698)

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2022-40698

MEDIUM CVSS 5.4 2022-11-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Security Vulnerability (CVE-2022-41652)

Bypass vulnerability in Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2022-41652

MEDIUM CVSS 6.5 2022-11-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2021-36905)

Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36905

MEDIUM CVSS 5.4 2022-11-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Security Vulnerability (CVE-2021-36906)

Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36906

LOW CVSS 2.7 2022-11-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - SQL Injection (CVE-2021-36898)

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36898

HIGH CVSS 7.5 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2021-36864)

Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36864

LOW CVSS 3.4 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2021-36863)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36863

MEDIUM CVSS 5.4 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Security Vulnerability (CVE-2021-36865)

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz And Survey Master

CVE-2021-36865

LOW CVSS 3.8 2022-09-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Request Forgery (CSRF) (CVE-2022-0180)

Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.

PLUGIN Quiz And Survey Master

CVE-2022-0180

HIGH CVSS 8.8 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2022-0181)

Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.

PLUGIN Quiz And Survey Master

CVE-2022-0181

MEDIUM CVSS 6.1 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2022-0182)

Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.

PLUGIN Quiz And Survey Master

CVE-2022-0182

MEDIUM CVSS 5.4 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2021-24691)

The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

PLUGIN Quiz And Survey Master

CVE-2021-24691

MEDIUM CVSS 4.8 2021-10-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2021-20792)

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

PLUGIN Quiz And Survey Master

CVE-2021-20792

MEDIUM CVSS 6.1 2021-08-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Privilege Escalation (CVE-2021-24368)

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link

PLUGIN Quiz And Survey Master

CVE-2021-24368

MEDIUM CVSS 6.1 2021-06-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - SQL Injection (CVE-2021-24221)

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.

PLUGIN Quiz And Survey Master

CVE-2021-24221

HIGH CVSS 8.8 2021-04-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Remote Code Execution (CVE-2020-35949)

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.

PLUGIN Quiz And Survey Master

CVE-2020-35949

CRITICAL CVSS 10.0 2021-01-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Security Vulnerability (CVE-2020-35951)

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

PLUGIN Quiz And Survey Master

CVE-2020-35951

CRITICAL CVSS 9.9 2021-01-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz And Survey Master - Cross-Site Scripting (XSS) (CVE-2016-11085)

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

PLUGIN Quiz And Survey Master

CVE-2016-11085

MEDIUM CVSS 6.5 2020-08-16

Risk Score

Open Full Technical Breakdown