CVE-2026-116509

The Quiz and Survey Master (QSM) plugin for WordPress (versions up to and including 11.2.9 ) is vulnerable to a generic SQL Injection via the 'qpages' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient preparation on the existing SQL query. Authenti...