EUVD-2026-59860

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11780 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11780

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73080

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73093

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824

The CVE describes a DOM-based stored XSS in the WordPress plugin Quiz and Survey Master (QSM) , version prior to 11.2.2 . The issue arises because a question setting is not properly escaped when output into an unquoted HTML attribute, enabling users with contributor-level access and above to inje...

EUVD-2026-52585

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

EUVD-2026-51435

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

CVE-2026-12376 affects the Academy LMS WordPress plugin up to version 3.8.2. The REST endpoint quiz_attempts does not restrict access to owner-only data, allowing any authenticated user with subscriber-level access (or higher) to read every user’s quiz attempts across the site. This exposes perso...

CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-63240

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

EUVD-2026-50135

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

CVE-2026-63240

Technical details (affected software/versions, root cause, fix) are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-63240 Information disclosure vulnerability

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

CVE-2026-63240

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

PT-2026-65711

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...