QA
Product
Quiz And Survey Master
46
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 4High 14Medium 28Low 0
Watch
Add Quiz And Survey Master to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107862 | 6.5 | Oct 12 | WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability Affected: through 11.2.7 |
| CVE-2026-104391 | 6.5 | Oct 7 | WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability Affected: through 11.2.7 |
| CVE-2025-9318 | 6.5 | Jan 6 | Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter Affected: before 10.3.2 |
| CVE-2025-9637 | 6.5 | Jan 6 | Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads Affected: before 10.3.2 |
| CVE-2024-3592 | 6.5 | Jun 7 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up… Affected: before 9.0.2 |
| CVE-2016-11085 | 6.5 | Aug 16 | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because… Affected: before 4.7.9 |
| CVE-2024-10679 | 6.1 | Mar 25 | Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS Affected: before 9.2.1 |
| CVE-2022-4032 | 6.1 | Nov 29 | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient… Affected: through 8.0.4 |
| CVE-2022-40698 | 6.1 | Nov 18 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress Affected: before 7.3.11 |
| CVE-2022-0181 | 6.1 | Jan 17 | Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors Affected: before 7.3.7 |
| CVE-2021-20792 | 6.1 | Aug 18 | Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors Affected: before 7.1.14 |
| CVE-2021-24368 | 6.1 | Jun 20 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz… Affected: before 7.1.18 |
| CVE-2019-17599 | 6.1 | Dec 13 | The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS) Affected: before 6.3.5 |
| CVE-2024-6390 | 5.9 | Aug 3 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as… Affected: before 9.1.0 |
| CVE-2024-4934 | 5.5 | Jul 1 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is… Affected: before 9.0.2 |
| CVE-2024-6025 | 5.4 | Jul 11 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored… Affected: before 9.0.5 |
| CVE-2023-3575 | 5.4 | Aug 7 | The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to… Affected: before 8.1.11 |
| CVE-2021-36905 | 5.4 | Nov 17 | Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress Affected: before 7.3.5 |
| CVE-2021-36864 | 5.4 | Oct 28 | WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability Affected: through 7.3.4 |
| CVE-2021-36863 | 5.4 | Oct 28 | WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability Affected: through 7.3.4 |
| CVE-2022-0182 | 5.4 | Jan 17 | Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website… Affected: before 7.3.7 |
| CVE-2023-51507 | 5.3 | Jun 14 | Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16 Affected: before 8.1.17 |
| CVE-2022-4033 | 5.3 | Nov 29 | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to… Affected: through 8.0.4 |
| CVE-2024-8758 | 4.8 | Sep 23 | Quiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSS Affected: before 9.1.3 |
| CVE-2021-24691 | 4.8 | Oct 11 | The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to… Affected: before 7.3.2 |
| CVE-2024-6879 | 4.7 | Aug 26 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is… Affected: before 9.1.1 |
| CVE-2025-9294 | 4.3 | Jan 6 | Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion Affected: before 10.3.2 |
| CVE-2023-37984 | 4.3 | Dec 13 | WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability Affected: through 8.1.10 |
Showing 28