What’s Vulnerable › Vulnerabilities

CVE-2025-9637: Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-06 · updated 2026-10-07
• Weakness: CWE-862

Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.

Affected products

• ExpressTech Quiz And Survey Master: before 10.3.2 — fixed in 10.3.2

How to fix

Upgrade to a fixed version: ExpressTech Quiz And Survey Master 10.3.2. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L1987
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L281
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=cve

Get alerted when CVE-2025-9637 or the next vulnerability affects your stack