CVE-2025-9294: Improper Authorization

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsmdashboarddeleteresult function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers,...

CVE-2025-6790: Undefined Security Weakness

The Quiz and Survey Master QSM WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10679: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8758

The Quiz and Survey Master QSM WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8758: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6879

The Quiz and Survey Master QSM WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting XSS attacks...

CVE-2024-6879: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting XSS attacks...

CVE-2024-6390

The Quiz and Survey Master (QSM) WordPress plugin versions prior to 9.1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain quiz settings. This flaw allows users with high privileges, such as contributors , to perfor...

CVE-2024-6390 Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-6390: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-6025: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks...

CVE-2024-5606

The CVE-2024-5606 entry concerns the WordPress plugin Quiz And Survey Master (QSM) prior to version 9.0.2. A SQL injection affects the qsm_bulk_delete_question_from_database AJAX action due to lack of validation/escaping for the question_id parameter. Public details in connected sources (e.g., Pa...

CVE-2024-5606: Improper Neutralization of Special Elements used in an SQL Command

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 is vulnerable does not validate and escape the questionid parameter in the qsmbulkdeletequestionfromdatabase AJAX action, leading to a SQL injection exploitable by Contributors and above role...

CVE-2024-4934

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-4934: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-16147

Name of the Vulnerable Software and Affected Versions Quiz And Survey Master plugin for WordPress versions up to, and including, 8.0.8 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the function associated with the qsm remove file fd question AJA...

PT-2021-15765

Name of the Vulnerable Software and Affected Versions: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress versions prior to 7.1.12 Description: The issue arises from the lack of sanitization of the result id GET parameter on pages with the qsm result shortcode without an...

PT-2021-11883

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin versions prior to 7.0.1 for WordPress Description: An issue in the Quiz and Survey Master plugin allows users to delete arbitrary files, such as the wp-config.php file, which could take a site offline and allow a...