CVE-2026-66634

The Modal Survey WordPress plugin (versions ≤ 2.0.2.2.3) contains an IDOR flaw allowing authenticated subscribers to access or modify objects without authorization. Patchstack reports it; no patch version or exploitation evidence is provided in the documents. Upgrade to a newer version if availab...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

WordPress Quiz and Survey Master (QSM) plugin <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'questiontitle' Parameter vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Quiz And Survey Master versions = 11.2.1...

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...

PT-2026-77062

Name of the Vulnerable Software and Affected Versions Modal Survey versions prior to 2.0.2.2.4 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to...

CVE-2026-15963

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-15963

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

EUVD-2026-59866

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-15963

The CVE-2026-15963 entry concerns the WordPress plugin Quiz and Survey Master (QSM). It describes a generic SQL injection via the 'randon_category' option affecting all versions up to 11.2.1, caused by insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. ...

CVE-2026-15963 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-11780

Product/Component: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. Flaw: Stored Cross-Site Scripting via the parameter 'question_title' (also referred to as 'question title' in some sources) due to insufficient input sanitization and output escaping. Versions affected:...

CVE-2026-11780 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-59860

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11780

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11780 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73080

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73093

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-18403 LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database CPDB workflow that copies survey participant tokens to the central participant list...