Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVE-2026-107862 is a DOM-based Cross-site Scripting (XSS) vulnerability in the ExpressTech Quiz And Survey Master plugin (quiz-master-next) affecting versions prior to 11.2.8. This vulnerability arises from improper neutralization of input during web page generation, allowing potentially malicious scripts to execute in the context of a user's browser. The issue impacts confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No known exploits are reported in the wild, and no official patch or vendor advisory is provided in the input data. Users should check vendor resources for remediation status.
The Quiz and Survey Master (QSM) plugin for WordPress has a stored DOM-based cross-site scripting (XSS) vulnerability in the 'qsm_hidden_questions' parameter affecting all versions up to and including 11.2.6. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires triggering a failure in the mlw_results INSERT operation by submitting an over-length or duplicate qsm_unique_key, causing unescaped payloads to be written to the audit trail.
CVE-2026-104392 is a high-severity vulnerability in the ExpressTech Quiz And Survey Master plugin (quiz-master-next) that allows deserialization of untrusted data leading to object injection. This affects versions from initial releases up to 11.2.7. The vulnerability can result in complete compromise of confidentiality, integrity, and availability of the affected system.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVE-2026-97289 is a high-severity cross-site scripting (XSS) vulnerability in the ExpressTech Quiz And Survey Master plugin, affecting versions from initial release up to 11.2.6. The vulnerability involves improper neutralization of input during web page generation, leading to DOM-based XSS. This can allow an attacker to execute arbitrary scripts in the context of the affected web application. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant risk. No official patch or remediation details are provided in the available data.
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and above (who can own a quiz they are entitled to edit), to plant a SQL payload that is executed second-order whenever any user (including an administrator) views the quiz's Questions tab, allowing them to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID to obtain a valid nonce bound to that quiz ID and their own user ID, then presents that nonce to the /quizzes/{id}/emails save endpoint, which accepts it without verifying quiz ownership.
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
CVE-2026-48867 is a high-severity vulnerability in ExpressTech's Quiz And Survey Master plugin, affecting versions up to and including 11.1.2. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks due to improper input neutralization during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available.
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions up to and including 11.1.2 is vulnerable to a time-based blind SQL Injection via the 'order' parameter. This vulnerability allows authenticated users with admin-level privileges or higher to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. Exposure of the secret key could enable exploitation by lower-privileged users.
The Quiz And Survey Master (QSM) WordPress plugin up to version 11.1.0 is vulnerable to arbitrary shortcode execution due to improper sanitization of user-submitted quiz answers. The plugin executes do_shortcode() on quiz results output, allowing injected shortcodes to run. This enables unauthenticated attackers to inject shortcodes like [qsm_result id=X] to view other users' quiz submissions without authorization. The vulnerability arises because sanitize_text_field() and htmlspecialchars() do not remove shortcode brackets, and the qsm_result shortcode lacks authorization checks.
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.