VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker security & vulnerabilities

quiz-master-next— active installsLast vulnerability Nov 12, 2026

No known unpatched vulnerabilities in the latest version

All 84 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
84Known vulnerabilities
  • Critical4
  • High17
  • Medium63
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152016: 1 vulnerability1162019: 2 vulnerabilities2192020: 4 vulnerabilities4202021: 6 vulnerabilities6212022: 16 vulnerabilities16222023: 10 vulnerabilities10232024: 7 vulnerabilities7242025: 5 vulnerabilities5252026: 32 vulnerabilities3226

All Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.5Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
≤11.2.9Update to 11.3.0
CVE-2026-116509
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter
≤11.2.7Update to 11.2.8
CVE-2026-103917
High7.5Authenticated (Contributor+) PHP Object Injection
≤11.2.7Update to 11.2.8
CVE-2026-111408
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.2.7Update to 11.2.8
CVE-2026-107862
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
≤11.2.6Update to 11.2.7
CVE-2026-96558
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.2.7Update to 11.2.8
CVE-2026-104391
High7.5Authenticated (Contributor+) PHP Object Injection
≤11.2.7Update to 11.2.8
CVE-2026-104392
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.2.6Update to 11.2.7
CVE-2026-97289
Medium5.3Unauthenticated Insecure Direct Object Reference
≤11.2.5Update to 11.2.6
CVE-2026-62140
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
<11.2.4Update to 11.2.4
CVE-2026-79615
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
≤11.2.3Update to 11.2.4
CVE-2026-14825
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
≤11.2.3Update to 11.2.4
CVE-2026-14826
Medium6.5Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
≤11.2.1Update to 11.2.2
CVE-2026-15963
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
≤11.2.1Update to 11.2.2
CVE-2026-11780
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.2.1Update to 11.2.2
CVE-2026-14824
Medium6.5Authenticated (Contributor+) SQL Injection
≤11.2.0Update to 11.2.1
CVE-2026-65454
Medium6.5Authenticated (Custom+) SQL Injection via 'pages' Parameter
≤11.2.0Update to 11.2.1
CVE-2026-13767
Medium4.3Missing Authorization
≤11.1.4Update to 11.1.5
CVE-2026-14821
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure
≤11.1.4Update to 11.1.5
CVE-2026-9230
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
≤11.1.4Update to 11.1.5
CVE-2026-9233
Medium4.9Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
≤11.1.2Update to 11.1.3
CVE-2026-6448
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.1.2Update to 11.1.3
CVE-2026-48867
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.0.0Update to 11.1.0
CVE-2026-40787
Medium5.3Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
≤10.1.0Update to 11.1.1
CVE-2026-5797
Medium6.5Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
≤10.3.5Update to 11.0.0
CVE-2026-2412
Medium4.3Missing Authorization
≤10.3.4Update to 10.3.5
CVE-2026-25329
Medium5.3Unauthenticated Insecure Direct Object Reference
≤10.3.4Update to 10.3.5
CVE-2026-25324
Medium6.5Authenticated (Subscriber+) SQL Injection
≤10.3.1Update to 10.3.2
CVE-2025-67987
Medium4.3Missing Authorization
≤10.3.3Update to 10.3.4
CVE-2026-24358
Medium6.5Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
≤10.3.1Update to 10.3.2
CVE-2025-9637
Medium6.5Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter
≤10.3.1Update to 10.3.2
CVE-2025-9318
Medium4.3Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion
≤10.3.1Update to 10.3.2
CVE-2025-9294
Medium5.3Missing Authorization
≤10.3.2Update to 10.3.3
CVE-2025-63054
High8.1Unauthenticated PHP Object Injection
≤10.2.5Update to 10.2.6
CVE-2025-49401
Medium6.5Authenticated (Contributor+) SQL Injection
≤10.2.4Update to 10.2.5
CVE-2025-55708
Medium4.3Cross-Site Request Forgery to Template Creation
≤10.2.2Update to 10.2.3
CVE-2025-6790
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤9.2.0Update to 9.2.1
CVE-2024-10679
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤9.1.2Update to 9.1.3
CVE-2024-8758
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.1.0Update to 9.1.1
CVE-2024-6879
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.0.5Update to 9.1.0
CVE-2024-6390
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.0.4Update to 9.0.5
CVE-2024-6025
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.0.1Update to 9.0.2
CVE-2024-4934
Critical9.9Authenticated (Contributor+) SQL Injection
≤9.0.1Update to 9.0.2
CVE-2024-3592
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤8.2.2Update to 8.2.3
CVE-2024-27966
Medium5.3Missing Authorization
≤8.1.16Update to 8.1.17
CVE-2023-51507
Medium4.3Cross-Site Request Forgery
≤8.1.18Update to 8.1.19
CVE-2023-51521
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.1.13Update to 8.1.14
CVE-2023-47834
Medium4.3Cross-Site Request Forgery via 'display_results'
<8.1.15Update to 8.1.16
—
Medium5.3Excessive Quiz Attempts
≤8.1.10Update to 8.1.11
CVE-2023-37984
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title
≤8.1.10Update to 8.1.11
CVE-2023-3575
Critical9.8Unauthenticated SQL Injection
≤8.1.4Update to 8.1.5
CVE-2023-28787
Medium4.3Cross-Site Request Forgery to Quiz Restoration
≤8.0.10Update to 8.1.0
CVE-2023-26524
High7.2Unauthenticated Arbitrary Media Deletion
≤8.0.8Update to 8.0.9
CVE-2023-0291
Medium5.4Cross-Site Request Forgery to Arbitrary Media Deletion
≤8.0.8Update to 8.0.9
CVE-2023-0292
Medium4.3Cross-Site Request Forgery
≤8.0.7Update to 8.0.8
CVE-2022-46862
High7.2Unauthenticated iFrame Injection via Paragraph and Short Answer
≤8.0.4Update to 8.0.5
CVE-2022-4032
Medium5.3Improper Input Validation
≤8.0.4Update to 8.0.5
CVE-2022-4033
High8.8Cross-Site Request Forgery
≤7.3.10Update to 7.3.11
—
Medium5.3Sensitive Information Disclosure
≤7.3.10Update to 7.3.11
CVE-2022-42883
High7.2Authenticated (Administrator+) SQL Injection
≤7.3.4Update to 7.3.5
CVE-2021-36898
Medium5.4Insecure Direct Object Reference
≤7.3.6Update to 7.3.7
CVE-2021-36906
High7.2Unauthenticated Stored Cross-Site Scripting
≤7.3.10Update to 7.3.11
CVE-2022-40698
Medium6.1Reflected Cross-Site Scripting
≤7.3.4Update to 7.3.5
CVE-2021-36864
Medium4.3Missing Authorization
≤7.3.10Update to 7.3.11
CVE-2022-41652
Medium6.4Multiple Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.3.4Update to 7.3.5
CVE-2021-36905
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.3.4Update to 7.3.5
CVE-2021-36863
Medium5.4Insecure Direct Object Reference
≤7.3.4Update to 7.3.5
CVE-2021-36865
High8.8Cross-Site Request Forgery
≤7.3.5Update to 7.3.7
CVE-2022-0180
Medium5.4Stored Cross-Site Scripting
≤7.3.6Update to 7.3.7
CVE-2022-0182
Medium5.4Reflected Cross-Site Scripting
≤7.3.6Update to 7.3.7
CVE-2022-0181
Medium6.1Cross-Site Scripting
≤7.1.13Update to 7.1.14
CVE-2021-20792
Medium4.8Admin+ Stored Cross-Site Scripting
≤7.3.1Update to 7.3.2
CVE-2021-24691
Medium6.1SQL Injection
≤7.1.13Update to 7.1.14
—
Medium6.1Reflected Cross-Site Scripting
≤7.1.17Update to 7.1.18
CVE-2021-24368
Medium6.4Cross-Site Scripting
<7.1.19Update to 7.1.19
—
High8.8Authenticated SQL injection via shortcode
≤7.1.11Update to 7.1.12
CVE-2021-24221
Critical9.8Arbitrary File Upload
≤7.0.1Update to 7.0.2
—
Critical9.8Arbitrary File Upload
<7.0.1Update to 7.0.1
CVE-2020-35949
High8.2Unauthenticated Arbitrary File Deletion
<7.0.1Update to 7.0.1
CVE-2020-35951
Medium6.4Stored Cross-Site Scripting
≤6.4.12Update to 7.0.0
—
Medium6.1Reflected Cross-Site Scripting
≤6.3.4Update to 6.3.5
CVE-2019-17599
Medium6.1Cross-Site Scripting
≤6.2.1Update to 6.2.2
CVE-2019-9575
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
<4.7.9Update to 4.7.9
CVE-2016-11085
High8.8Multiple SQL Injections
<4.4.4Update to 4.4.4
—

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: common questions

Does Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker have known vulnerabilities?

Yes. VulnCrest Radar lists 84 known vulnerabilities in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: 4 critical, 17 high, 63 medium. None are known to affect version null.

How do I check which version of Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerability?

CVE-2026-116509, published Nov 12, 2026: Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter. Severity: Medium (CVSS 6.5).

Is any Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerability listed in CISA KEV?

No. None of the known Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?