What’s Vulnerable › Vulnerabilities

CVE-2021-24221: Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-12 · updated 2026-06-17
• Weakness: CWE-89

Description

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.

Affected products

• ExpressTech Quiz And Survey Master: before 7.1.12 — fixed in 7.1.12

How to fix

Upgrade to a fixed version: ExpressTech Quiz And Survey Master 7.1.12. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2479603/
• https://wpscan.com/vulnerability/3b52b25c-82a1-41c7-83ac-92e244f7c5ab
• https://plugins.trac.wordpress.org/changeset/2479603/
• https://wpscan.com/vulnerability/3b52b25c-82a1-41c7-83ac-92e244f7c5ab

Get alerted when CVE-2021-24221 or the next vulnerability affects your stack