Quiz And Survey Master Qsm
Monthly
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. No confirmed active exploitation is recorded in CISA KEV, but a publicly available proof-of-concept is documented by WPScan, making opportunistic exploitation trivial for any authenticated site member.
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. No confirmed active exploitation is recorded in CISA KEV, but a publicly available proof-of-concept is documented by WPScan, making opportunistic exploitation trivial for any authenticated site member.
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.