CVE-2020-35949

The CVE-2020-35949 entry concerns the WordPress plugin Quiz and Survey Master before 7.0.1. Affected component: file upload handler in quiz questions. Root cause: only Content-Type is validated during upload, allowing unauthenticated attackers to upload arbitrary files (e.g., .php as text/plain) ...

CVE-2020-35951

CVE-2020-35951 affects the WordPress plugin Quiz and Survey Master in versions prior to 7.0.1. The issue is an arbitrary file deletion vulnerability: the function qsm_remove_file_fd_question can delete arbitrary files (e.g., wp-config.php) unauthenticated, potentially taking the site offline and ...

CVE-2021-24368

The CVE-2021-24368 entry concerns the WordPress plugin Quiz And Survey Master (before 7.1.18). The vulnerability is a reflected Cross-Site Scripting (XSS) in the result_id parameter on the existing quiz results page due to inadequate sanitisation/escaping. Impact described: could enable privilege...

CVE-2023-26524

The CVE-2023-26524 entry concerns a CSRF vulnerability in the WordPress plugin Quiz And Survey Master (ExpressTech) , affecting versions up to 8.0.10 . The issue exposes a risk to unauthenticated users that could impact integrity, confidentiality, and availability as indicated by CVSS metrics (NV...

CVE-2021-20792

CVE-2021-20792 affects WordPress plugin “Quiz And Survey Master” (pre-7.1.14). A cross-site scripting vulnerability allows a remote attacker to inject arbitrary script via unspecified vectors. Exploitation details are not fully disclosed in the provided documents, but the Nuclei template and rela...

CVE-2024-4934

CVE-2024-4934 affects the Quiz and Survey Master (QSM) WordPress plugin, before version 9.0.2. The root cause is that certain quiz fields are not validated or escaped before being output on pages/posts where the quiz is embedded, enabling Stored XSS by users with the Contributor role or higher. R...

CVE-2023-0291

CVE-2023-0291 affects the WordPress plugin Quiz And Survey Master (versions up to and including 8.0.8). The issue is a missing capability check in the function tied to the qsm_remove_file_fd_question AJAX action, enabling unauthenticated attackers to delete arbitrary media files. Connected source...

CVE-2021-36864

Summary of CVE-2021-36864 : Affected product is the WordPress plugin “Quiz And Survey Master” (aka ExpressTech Quiz And Survey Master)

CVE-2024-5606

The CVE-2024-5606 entry concerns the WordPress plugin Quiz And Survey Master (QSM) prior to version 9.0.2. A SQL injection affects the qsm_bulk_delete_question_from_database AJAX action due to lack of validation/escaping for the question_id parameter. Public details in connected sources (e.g., Pa...

CVE-2023-3575

The CVE-2023-3575 entry concerns the WordPress plugin Quiz And Survey Master. Affected software: Quiz And Survey Master plugin prior to version 8.1.11. Vulnerability: improper sanitization/escaping of question titles, enabling Stored Cross-Site Scripting. Exploitation: requires Contributor role o...

CVE-2022-41652

CVE-2022-41652 affects the WordPress Quiz And Survey Master plugin up to version 7.3.10, described as a bypass vulnerability. Public sources consistently refer to a bypass of security controls in this plugin version. Impact details in the connected records indicate potential effects on confidenti...

CVE-2022-42883

CVE-2022-42883 describes a sensitive information disclosure in the WordPress plugin Quiz And Survey Master for versions prior to 7.3.11 (up to 7.3.10). The vulnerability affects the plugin’s handling of data and could reveal sensitive information. The practical impact and exact root cause are not...

CVE-2019-17599

The CVE-2019-17599 entry affects the WordPress plugin Quiz Master Next (Quiz And Survey Master) up to version 6.3.5. The vulnerability is a reflected XSS in the admin/quiz-options-page.php component that can be triggered via parameters such as from, till, or quiz_id when an administrator clicks a...

CVE-2024-3592

CVE-2024-3592 (Quiz and Survey Master for WordPress) is confirmed as a valid SQL Injection vulnerability in all versions up to 9.0.1, caused by insufficient escaping and improper query construction on the question_id parameter. Exploitation requires authenticated access at contributor level or hi...

CVE-2021-36906

The CVE refers to IDOR vulnerabilities in the ExpressTech Quiz And Survey Master WordPress plugin, specifically versions up to 7.3.6. The root cause is insufficient authorization checks that allow insecure direct object references, enabling actions such as deleting or duplicating quizzes by users...

CVE-2022-4032

The CVE-2022-4032 entry concerns the WordPress plugin Quiz and Survey Master. Affected versions are up to and including 8.0.4. The root cause is insufficient input sanitization and output escaping for the question[id] parameter, allowing unauthenticated attackers to inject iframe tags into pages....

CVE-2021-36863

The CVE-2021-36863 entry covers a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin ExpressTech Quiz And Survey Master (versions

CVE-2023-51507

Technical details about CVE-2023-51507 are not provided in the supplied documents. No explicit affected versions beyond 8.1.16 or remediation steps are listed; monitor for updates.

CVE-2021-36898

CVE-2021-36898 documents a vulnerability in the WordPress plugin “Quiz And Survey Master” (also referred to as Quiz Master Next). Affected versions are

CVE-2022-0180

CVE-2022-0180 affects WordPress plugin Quiz And Survey Master up to version

CVE-2022-0181

The CVE-2022-0181 entry concerns the WordPress plugin Quiz And Survey Master by ExpressTech (versions prior to 7.3.7). The root cause is insufficient processing of user-supplied data, resulting in a reflected cross-site scripting (CWE-79) vulnerability. Impact states that an arbitrary script can ...

CVE-2022-40698

Summary: CVE-2022-40698 is a cross-site scripting (XSS) vulnerability affecting the WordPress plugin “Quiz And Survey Master” (versions

CVE-2022-0182

CVE-2022-0182 concerns the WordPress plugin Quiz And Survey Master. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 7.3.7, enabling a remote authenticated attacker to inject arbitrary scripts via a website using the plugin. Impact details in the connected reports des...

CVE-2022-46862

CVE-2022-46862 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin, affecting versions up to 8.0.7. The root cause is insufficient CSRF protection for plugin actions. A fix is available in versi...

CVE-2024-10679

CVE-2024-10679 affects the Quiz and Survey Master (QSM) WordPress plugin prior to 9.2.1. The issue is stored Cross-Site Scripting caused by insufficient sanitization/escaping of certain settings, enabling high-privilege users (e.g., admins) to inject scripts even when unfiltered_html is disallowe...

CVE-2021-24691

CVE-2021-24691 documents a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Quiz And Survey Master” before version 7.3.2. The root cause, as stated in multiple sources, is that the plugin does not escape the Quiz Url Slug setting before output in certain pages, enabling hi...

CVE-2021-36905

The CVE-2021-36905 entry describes a stored XSS vulnerability in the WordPress Quiz And Survey Master plugin (versions

CVE-2022-4033

The CVE concerns the WordPress plugin Quiz and Survey Master. Affected: Quiz and Survey Master plugin for WordPress, versions up to and including 8.0.4. Root cause: insufficient input validation in the handling of the question[id] parameter, enabling input validation bypass. What’s vulnerable: th...

CVE-2016-11085

The CVE-2016-11085 vulnerability affects the WordPress plugin Quiz Master Next (quiz-master-next) pre-4.7.9. The issue is a CSRF that results in stored XSS via the question_name parameter, caused by how js/admin_question.js parses within a SCRIPT element. Evidence from multiple sources confirms t...

CVE-2024-8758

CVE-2024-8758 affects the Quiz and Survey Master (QSM) WordPress plugin prior to version 9.1.3. The issue is stored XSS caused by insufficient sanitization/escaping of settings, potentially allowing high-privilege users (e.g., admins) to inject scripts even when unfiltered_html is disallowed (e.g...

CVE-2024-6025

The CVE-2024-6025 entry concerns the WordPress plug-in Quiz and Survey Master (QSM) prior to version 9.0.5. Multiple connected sources confirm a Stored Cross-Site Scripting vulnerability arising from insufficient sanitisation/escaping of certain quiz settings, enabling an attacker with Contributo...

CVE-2023-0292

CVE-2023-0292 concerns the WordPress plugin “Quiz And Survey Master” (WordPress) up to version 8.0.8. The issue is a Cross-Site Request Forgery (CSRF) vulnerability caused by missing nonce validation on the AJAX handler qsm_remove_file_fd_question. This enables unauthenticated attackers to delete...

CVE-2021-24221

CVE-2021-24221 affects the WordPress plugin “Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress” (before version 7.1.12). The issue is an SQL injection in the shortcode [qsm_result] when used without an id attribute and with a result_id GET parameter, which is concatenated i...

CVE-2024-6879

The CVE-2024-6879 entry concerns the Quiz and Survey Master (QSM) WordPress plugin, affected when versions prior to 9.1.1 fail to validate and escape certain quiz fields displayed on embedded pages, enabling Stored XSS by Contributor+ users. Public documentation across Red Hat, Patchstack, OSV, a...

CVE-2024-6390

The CVE-2024-6390 issue affects the WordPress plugin "Quiz and Survey Master (QSM)" prior to version 9.1.0. The vulnerability arises from insufficient sanitization/escaping of certain Quiz settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., Contributors). Th...

CVE-2025-9318

CVE-2025-9318 affects the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. A time-based SQL Injection via the is_linking parameter exists in all versions up to 10.3.1 due to insufficient escaping and improper query preparation. Exploitation requires Subscriber-level (or...

CVE-2025-9637

CVE-2025-9637 (Quiz and Survey Master, QSM) Affected: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker for WordPress, versions up to and including 10.3.1. Root cause: missing capability and status checks on multiple functions, enabling unauthenticated users to view unpublished/private/pa...

CVE-2025-9294

CVE-2025-9294 affects the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. Root cause: missing capability check in qsm_dashboard_delete_result, enabling authenticated users with Subscriber-level access and above to delete quiz results on all versions up to 10.3.1. Wordf...