EUVD-2026-49083
GHSA-95j9-j2xw-62q9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
AnalysisAI
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
More in Quiz And Survey Master Qsm
View allStored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answ
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level per
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today