Threat Database (40)

Threat Entry Updated 2026-06-17

Quiz Master Next - Broken Access Control (CVE-2025-9294)

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.

PLUGIN Quiz Master Next

CVE-2025-9294

MEDIUM CVSS 4.3 2026-01-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Broken Access Control (CVE-2025-63054)

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through

PLUGIN Quiz Master Next

CVE-2025-63054

MEDIUM CVSS 5.3 2025-12-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - SQL Injection (CVE-2025-55708)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through

PLUGIN Quiz Master Next

CVE-2025-55708

HIGH CVSS 8.5 2025-08-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Broken Access Control (CVE-2023-37984)

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.

PLUGIN Quiz Master Next

CVE-2023-37984

MEDIUM CVSS 4.3 2024-12-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - SQL Injection (CVE-2024-3592)

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-5606 appears to be a…

PLUGIN Quiz Master Next

CVE-2024-3592

CRITICAL CVSS 9.9 2024-06-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Request Forgery (CSRF) (CVE-2023-0292)

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Quiz Master Next

CVE-2023-0292

MEDIUM CVSS 5.4 2023-06-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Broken Access Control (CVE-2023-0291)

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

PLUGIN Quiz Master Next

CVE-2023-0291

HIGH CVSS 7.2 2023-06-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2021-36905)

Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36905

MEDIUM CVSS 5.4 2022-11-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Security Vulnerability (CVE-2021-36906)

Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36906

LOW CVSS 2.7 2022-11-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - SQL Injection (CVE-2021-36898)

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36898

HIGH CVSS 7.5 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2021-36864)

Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36864

LOW CVSS 3.4 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2021-36863)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36863

MEDIUM CVSS 5.4 2022-10-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Security Vulnerability (CVE-2021-36865)

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin

PLUGIN Quiz Master Next

CVE-2021-36865

LOW CVSS 3.8 2022-09-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Request Forgery (CSRF) (CVE-2022-0180)

Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.

PLUGIN Quiz Master Next

CVE-2022-0180

HIGH CVSS 8.8 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2022-0181)

Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.

PLUGIN Quiz Master Next

CVE-2022-0181

MEDIUM CVSS 6.1 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2022-0182)

Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.

PLUGIN Quiz Master Next

CVE-2022-0182

MEDIUM CVSS 5.4 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2021-20792)

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

PLUGIN Quiz Master Next

CVE-2021-20792

MEDIUM CVSS 6.1 2021-08-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2016-11085)

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

PLUGIN Quiz Master Next

CVE-2016-11085

MEDIUM CVSS 6.5 2020-08-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2019-17599)

The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

PLUGIN Quiz Master Next

CVE-2019-17599

MEDIUM CVSS 6.1 2019-12-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Quiz Master Next - Cross-Site Scripting (XSS) (CVE-2019-9575)

The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.

PLUGIN Quiz Master Next

CVE-2019-9575

MEDIUM CVSS 6.1 2019-03-05

Risk Score

Open Full Technical Breakdown