Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker vulnerabilities

Product

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

by expresstech · last CVE Jul 3, 2026

CVEs

On KEV

9.1

Max CVSS

New 30D

Vulnerabilities13 In the news0 Timeline

Severity mix

Critical 1High 1Medium 11Low 0

Severity

All severities13 Critical1 High1 Medium11 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-0291	9.1	2%	Jun 9	Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion Affected: through 8.0.8
CVE-2023-0292	8.1	1%	Jun 9	Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion Affected: through 8.0.8
CVE-2026-2412	6.5	0%	Mar 23	Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter Affected: through 10.3.5
CVE-2025-9318	6.5	0%	Jan 6	Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter Affected: through 10.3.1
CVE-2025-9637	6.5	0%	Jan 6	Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads Affected: through 10.3.1
CVE-2024-3592	6.5	0%	Jun 7	Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection Affected: through 9.0.1
CVE-2022-4032	6.1	1%	Nov 29	Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer Affected: through 8.0.4
CVE-2026-5797	5.3	1%	Apr 17	Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields Affected: through 10.1.0
CVE-2022-4033	5.3	1%	Nov 29	Quiz and Survey Master <= 8.0.4 - Improper Input Validation Affected: through 8.0.4
CVE-2026-6448	4.9	0%	Jun 5	Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters Affected: through 11.1.2
CVE-2026-9230	4.3	0%	Jul 3	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure Affected: through 11.1.4
CVE-2026-9233	4.3	0%	Jun 27	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action Affected: through 11.1.4
CVE-2025-9294	4.3	0%	Jan 6	Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion Affected: through 10.3.1