WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

PT-2026-107456

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Vérificateur Python 3 et hook d'exploit configurable pour CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Produit| REDCap Vanderbilt Affecté| ≥ 13.3.0 jusqu'au correctif de branche Corrigé| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVS...

CVE-2026-105090: Incorrect Authorization

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

CVE-2026-97289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6...

CVE-2026-97289

The Quiz And Survey Master plugin for WordPress versions

EUVD-2026-89930

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-97289 WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6...

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Quiz And Survey Master versions = 11.2.6...

PT-2026-103262

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-97289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-97685

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

EUVD-2026-88608

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2026-97685

In LimeSurvey Community Edition 7.3.0 , an authenticated user with survey creation privileges can perform a cross-survey object authorization bypass via the REST survey-patching endpoint . While the endpoint correctly validates permissions against the survey ID in the URL, the underlying persiste...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

PT-2026-102439

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.3.0 Description An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the...

CVE-2026-97685: Authorization Bypass Through User-Controlled Key

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

REDCap 13.3.0+ Survey Passthrough Scanner

REDCap versions 13.3.0 and higher contain an unauthenticated remote code execution vulnerability in survey passthrough routing and Data Import processing. This Python tool fingerprints candidate instances, evaluates version information and public survey hashes, and probes relevant routes...