CVE-2021-24221

CVE-2021-24221 affects the WordPress plugin “Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress” (before version 7.1.12). The issue is an SQL injection in the shortcode [qsm_result] when used without an id attribute and with a result_id GET parameter, which is concatenated i...

CVE-2021-24221 Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the resultid GET parameter on pages with the qsmresult shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to...