What’s Vulnerable › Vulnerabilities
CVE-2026-14820: Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-27 · updated 2026-07-27
- Weakness: CWE-200
Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
Affected products
- ExpressTech Quiz And Survey Master: before 11.1.3 — fixed in 11.1.3
How to fix
Upgrade to a fixed version: ExpressTech Quiz And Survey Master 11.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14820 or the next vulnerability affects your stack