Expresstech Quiz And Survey Master vulnerabilities

CVE-2019-17599 [MEDIUM] CWE-79 CVE-2019-17599: The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Admi

CVE-2016-11085 [MEDIUM] CWE-79 CVE-2016-11085: php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows C php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

CVE-2022-4032 [MEDIUM] CWE-20 CVE-2022-4032: The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[ The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute w

CVE-2022-4033 [MEDIUM] CWE-20 CVE-2022-4033: The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'qu The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values

CVE-2023-51507 [MEDIUM] CWE-862 CVE-2023-51507: Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz An Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.

CVE-2022-0181 [MEDIUM] CWE-79 CVE-2022-0181: Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allow Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.

CVE-2021-24368 [MEDIUM] CWE-79 CVE-2021-24368: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did no The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link

CVE-2024-10679 [MEDIUM] CWE-79 CVE-2024-10679: The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2022-0182 [MEDIUM] CWE-79 CVE-2022-0182: Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.

CVE-2024-4934 [MEDIUM] CWE-79 CVE-2024-4934: The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVE-2023-3575 [MEDIUM] CWE-79 CVE-2023-3575: The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape ques The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks

CVE-2021-36863 [MEDIUM] CWE-79 CVE-2021-36863: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVE-2021-36905 [MEDIUM] CWE-79 CVE-2021-36905: Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey M Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVE-2023-47834 [MEDIUM] CWE-79 CVE-2023-47834: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

CVE-2024-6025 [MEDIUM] CWE-79 CVE-2024-6025: The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks

CVE-2022-40698 [MEDIUM] CWE-79 CVE-2022-40698: Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3 Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

CVE-2025-9294 [MEDIUM] CWE-285 CVE-2025-9294: The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete qu

CVE-2024-6390 [MEDIUM] CWE-79 CVE-2024-6390: The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escap The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

CVE-2021-36864 [MEDIUM] CWE-79 CVE-2021-36864: Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Ma Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVE-2024-6879 [MEDIUM] CWE-79 CVE-2024-6879: The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.