What’s Vulnerable › Products
ExpressTech Quiz And Survey Master vulnerabilities
61 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your ExpressTech Quiz And Survey Master version is affected
Latest ExpressTech Quiz And Survey Master vulnerabilities
- CVE-2026-111408 — WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability (CVSS 8.8)
- CVE-2026-107862 — WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-104392 — WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability (CVSS 8.8)
- CVE-2026-104391 — WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-97289 — WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-79615 — Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR (CVSS 2.7)
- CVE-2026-14826 — Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR (CVSS 2.7)
- CVE-2026-14825 — Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR (CVSS 2.7)
- CVE-2026-14824 — Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question (CVSS 4.8)
- CVE-2026-14821 — Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion (CVSS 2.7)
- CVE-2026-14820 — Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login (CVSS 5.3)
- CVE-2026-9230 — Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure (CVSS 4.3)
- CVE-2026-9233 — Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action (CVSS 4.3)
- CVE-2026-48867 — WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-40787 — WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-6448 — Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters (CVSS 4.9)
- CVE-2026-5797 — Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields (CVSS 5.3)
- CVE-2026-2412 — Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter (CVSS 6.5)
- CVE-2025-9637 — Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads (CVSS 6.5)
- CVE-2025-9318 — Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter (CVSS 6.5)
- CVE-2025-9294 — Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion (CVSS 4.3)
- CVE-2025-6790 — QSM < 10.2.3 - Template Creation via CSRF (CVSS 4.3)
- CVE-2024-10679 — Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS (CVSS 6.1)
- CVE-2023-37984 — WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2024-8758 — Quiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSS (CVSS 4.8)