Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
Quiz Master Next - Security Vulnerability (CVE-2026-103917)
The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and…
PLUGIN
Quiz Master Next
CVE-2026-103917
Risk Score
Threat Entry
Updated 2026-10-11
Quiz Master Next - Security Vulnerability (CVE-2026-96558)
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail…
PLUGIN
Quiz Master Next
CVE-2026-96558
Risk Score
Threat Entry
Updated 2026-10-09
Quiz Master Next - Security Vulnerability (CVE-2026-104392)
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
PLUGIN
Quiz Master Next
CVE-2026-104392
Risk Score
Threat Entry
Updated 2026-10-07
Quiz Master Next - Security Vulnerability (CVE-2026-104391)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
PLUGIN
Quiz Master Next
CVE-2026-104391
Risk Score
Threat Entry
Updated 2026-10-09
Quiz Master Next - Security Vulnerability (CVE-2026-97289)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
PLUGIN
Quiz Master Next
CVE-2026-97289
Risk Score
Threat Entry
Updated 2026-09-11
Quiz Master Next - Security Vulnerability (CVE-2026-62140)
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master
PLUGIN
Quiz Master Next
CVE-2026-62140
Risk Score
Threat Entry
Updated 2026-08-20
Quiz Master Next - SQL Injection (CVE-2026-15963)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Quiz Master Next
CVE-2026-15963
Risk Score
Threat Entry
Updated 2026-08-20
Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2026-11780)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Quiz Master Next
CVE-2026-11780
Risk Score
Threat Entry
Updated 2026-07-16
Quiz Master Next - SQL Injection (CVE-2026-13767)
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and…
PLUGIN
Quiz Master Next
CVE-2026-13767
Risk Score
Threat Entry
Updated 2026-07-06
Quiz Master Next - Broken Access Control (CVE-2026-9230)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID…
PLUGIN
Quiz Master Next
CVE-2026-9230
Risk Score
Threat Entry
Updated 2026-06-29
Quiz Master Next - Broken Access Control (CVE-2026-9233)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
PLUGIN
Quiz Master Next
CVE-2026-9233
Risk Score
Threat Entry
Updated 2026-07-23
Quiz Master Next - SQL Injection (CVE-2026-6448)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is…
PLUGIN
Quiz Master Next
CVE-2026-6448
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - Security Vulnerability (CVE-2026-5797)
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire results page output (including user answers), causing any injected shortcodes to be executed. This makes it possible…
PLUGIN
Quiz Master Next
CVE-2026-5797
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - SQL Injection (CVE-2026-2412)
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for…
PLUGIN
Quiz Master Next
CVE-2026-2412
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - SQL Injection (CVE-2025-67987)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through
PLUGIN
Quiz Master Next
CVE-2025-67987
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - Broken Access Control (CVE-2026-25329)
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through
PLUGIN
Quiz Master Next
CVE-2026-25329
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - Broken Access Control (CVE-2026-25324)
Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through
PLUGIN
Quiz Master Next
CVE-2026-25324
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - Broken Access Control (CVE-2026-24358)
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through
PLUGIN
Quiz Master Next
CVE-2026-24358
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - Arbitrary File Upload (CVE-2025-9637)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.
PLUGIN
Quiz Master Next
CVE-2025-9637
Risk Score
Threat Entry
Updated 2026-06-17
Quiz Master Next - SQL Injection (CVE-2025-9318)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Quiz Master Next
CVE-2025-9318
Risk Score