# Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.9 - Authenticated (Contributor+) SQL Injection via Quiz Page Data ('qpages')

- **ID:** WPSEC-2026-2226
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** all versions before 11.3.0
- **Fixed in:** 11.3.0 (Update to 11.3.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2226/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the stored quiz page data ('qpages') in all versions up to, and including, 11.2.9 due to insufficient sanitization of question IDs saved through the questions tab and insufficient preparation of the query that later places them into an IN() clause when the quiz is rendered. This makes it possible for authenticated attackers, with Contributor-level access and above, to store an SQL payload that is executed when the quiz is displayed, allowing them to append additional SQL queries to existing queries and extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-2226/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.0/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2226/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.