Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.9 - Authenticated (Contributor+) SQL Injection via Quiz Page Data ('qpages')
- ID
- WPSEC-2026-2226
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- all versions before 11.3.0
- Remediation
- Update to 11.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the stored quiz page data ('qpages') in all versions up to, and including, 11.2.9 due to insufficient sanitization of question IDs saved through the questions tab and insufficient preparation of the query that later places them into an IN() clause when the quiz is rendered. This makes it possible for authenticated attackers, with Contributor-level access and above, to store an SQL payload that is executed when the quiz is displayed, allowing them to append additional SQL queries to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-2226/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.0/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS