Expresstech Quiz And Survey Master vulnerabilities

CVE-2020-35951 [CRITICAL] CWE-306 CVE-2020-35951: An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows u An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed una

CVE-2023-28787 [CRITICAL] CWE-89 CVE-2023-28787: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.

CVE-2020-35949 [CRITICAL] CWE-434 CVE-2020-35949: An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use

CVE-2023-0291 [CRITICAL] CWE-862 CVE-2023-0291: The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capa The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

CVE-2021-20792 [MEDIUM] CWE-79 CVE-2021-20792: Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remot Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

CVE-2021-24221 [HIGH] CWE-89 CVE-2021-24221: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 di The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, su

CVE-2024-5606 [HIGH] CWE-89 CVE-2024-5606: The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role

CVE-2022-41652 [CRITICAL] CWE-284 CVE-2022-41652: Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

CVE-2021-36906 [HIGH] CWE-639 CVE-2021-36906: Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Mas Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.

CVE-2022-0180 [HIGH] CWE-352 CVE-2022-0180: Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 al Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.

CVE-2024-3592 [MEDIUM] CWE-89 CVE-2024-3592: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for

CVE-2025-9637 [MEDIUM] CWE-862 CVE-2025-9637: The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, privat

CVE-2025-9318 [MEDIUM] CWE-89 CVE-2025-9318: The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authe

CVE-2023-0292 [HIGH] CWE-352 CVE-2023-0292: The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versi The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request

CVE-2021-36898 [HIGH] CWE-89 CVE-2021-36898: Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress. Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVE-2022-42883 [HIGH] CWE-200 CVE-2022-42883: Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

CVE-2023-26524 [HIGH] CWE-352 CVE-2023-26524: Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, E Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.

CVE-2022-46862 [HIGH] CWE-352 CVE-2022-46862: Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, E Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.

CVE-2026-40787 [HIGH] CWE-79 CVE-2026-40787: Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions. Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

CVE-2026-48867 [HIGH] CWE-79 CVE-2026-48867: Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions. Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.