WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting

WordPress Watu Quiz plugin before 3.3.9.1 is susceptible to cross-site scripting. The plugin does not sanitize and escape some parameters, such as email, dn, date, and points, before outputting then back in a page. An attacker can inject arbitrary script in the browser of an unsuspecting user in...

Quiz and Survey Master <= 8.1.4 - SQL Injection

ExpressTech Quiz And Survey Master versions up to 8.1.4 contains an SQL injection caused by improper neutralization of special elements used in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires user interaction. id: CVE-2023-28787 info: name: Quiz and Survey Master =...

CVE-2026-116509

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-116509

The Quiz and Survey Master (QSM) plugin for WordPress (versions up to and including 11.2.9 ) is vulnerable to a generic SQL Injection via the 'qpages' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient preparation on the existing SQL query. Authenti...

CVE-2026-116509 Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-124989

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2021-36393

CVE-2021-36393 Error-based blind SQL injection with bit-shifting approach for Moodle 3.10.4. Allows an attacker to perform arbitrary database queries. For example, you can steal: test answers from the database Modify the script.js file and run it on route /mod/quiz/attempt.php?attempt=...&cmid=...

WordPress Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin <= 11.2.9 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Quiz And Survey Master versions = 11.2.9...

CVE-2024-6028-Poc

CVE-2024-6028-Poc CVE-2024-6028 Quiz Maker method getquestionscategories image image image Poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML,...

CVE-2024-1208-and-CVE-2024-1210

CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API in LearnDash. Unauthenticated visitors can browse the quizzes and quiz questions without being enrolled in a connected course. Vulnerability: CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API CVSS: 5.3...

CVE-2026-125786

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

CVE-2026-125787

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

CVE-2026-125786 WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

EUVD-2026-124149

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

CVE-2026-125786

The ExpressTech Quiz And Survey Master (quiz-master-next) WordPress plugin, in versions up to and including 11.3.0 , is susceptible to a Content Injection vulnerability. This issue is caused by the improper neutralization of script-related HTML tags in a web page, leading to a Basic XSS (CWE-80) ...

WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability

Content Injection vulnerability discovered by Benjamin Kincses Dextheking1 in WordPress Plugin Quiz And Survey Master versions = 11.3.0...

EUVD-2026-124148

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

CVE-2026-125787

The Quiz And Survey Master WordPress plugin (versions up to and including 11.3.0 ) is affected by a Broken Access Control vulnerability (CWE-862). The flaw arises from incorrectly configured access control security levels , specifically a missing authorization check in the quiz-master-next compon...

CVE-2026-125787 WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0...

WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Daniel Walker in WordPress Plugin Quiz And Survey Master versions = 11.3.0...