VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker security & vulnerabilities

quiz-master-next— active installsLast vulnerability Nov 12, 2026

No known unpatched vulnerabilities in the latest version

All 84 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
84Known vulnerabilities
  • Critical4
  • High17
  • Medium63
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152016: 1 vulnerability1162019: 2 vulnerabilities2192020: 4 vulnerabilities4202021: 6 vulnerabilities6212022: 16 vulnerabilities16222023: 10 vulnerabilities10232024: 7 vulnerabilities7242025: 5 vulnerabilities5252026: 32 vulnerabilities3226

All Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities
SeverityVulnerabilityCVEPublished
High7.5Authenticated (Contributor+) PHP Object Injection
≤11.2.7Update to 11.2.8
CVE-2026-111408
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
≤11.2.6Update to 11.2.7
CVE-2026-96558
High7.5Authenticated (Contributor+) PHP Object Injection
≤11.2.7Update to 11.2.8
CVE-2026-104392
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.2.6Update to 11.2.7
CVE-2026-97289
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.1.2Update to 11.1.3
CVE-2026-48867
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.0.0Update to 11.1.0
CVE-2026-40787
High8.1Unauthenticated PHP Object Injection
≤10.2.5Update to 10.2.6
CVE-2025-49401
Critical9.9Authenticated (Contributor+) SQL Injection
≤9.0.1Update to 9.0.2
CVE-2024-3592
Critical9.8Unauthenticated SQL Injection
≤8.1.4Update to 8.1.5
CVE-2023-28787
High7.2Unauthenticated Arbitrary Media Deletion
≤8.0.8Update to 8.0.9
CVE-2023-0291
High7.2Unauthenticated iFrame Injection via Paragraph and Short Answer
≤8.0.4Update to 8.0.5
CVE-2022-4032
High8.8Cross-Site Request Forgery
≤7.3.10Update to 7.3.11
—
High7.2Authenticated (Administrator+) SQL Injection
≤7.3.4Update to 7.3.5
CVE-2021-36898
High7.2Unauthenticated Stored Cross-Site Scripting
≤7.3.10Update to 7.3.11
CVE-2022-40698
High8.8Cross-Site Request Forgery
≤7.3.5Update to 7.3.7
CVE-2022-0180
High8.8Authenticated SQL injection via shortcode
≤7.1.11Update to 7.1.12
CVE-2021-24221
Critical9.8Arbitrary File Upload
≤7.0.1Update to 7.0.2
—
Critical9.8Arbitrary File Upload
<7.0.1Update to 7.0.1
CVE-2020-35949
High8.2Unauthenticated Arbitrary File Deletion
<7.0.1Update to 7.0.1
CVE-2020-35951
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
<4.7.9Update to 4.7.9
CVE-2016-11085
High8.8Multiple SQL Injections
<4.4.4Update to 4.4.4
—

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: common questions

Does Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker have known vulnerabilities?

Yes. VulnCrest Radar lists 84 known vulnerabilities in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: 4 critical, 17 high, 63 medium. None are known to affect version null.

How do I check which version of Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerability?

CVE-2026-116509, published Nov 12, 2026: Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter. Severity: Medium (CVSS 6.5).

Is any Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerability listed in CISA KEV?

No. None of the known Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?