Quiz And Survey Master Qsm Quiz Maker Survey Maker
Monthly
SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.
Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authenticated attackers holding at minimum a contributor role to inject persistent JavaScript payloads via the 'question_title' parameter. The injected script executes in the browser of any user who subsequently views a page containing the poisoned quiz, enabling session hijacking, credential harvesting, or unauthorized administrative actions. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; however, the scope change noted in the CVSS vector underscores that impact crosses the boundary from the injecting contributor into every visiting user's browser context.
Second-order SQL injection in Quiz Master Next (QSM) for WordPress through version 11.2.0 allows authenticated attackers holding Author-level access to plant SQL payloads in quiz page data that execute whenever any user - including administrators - views the affected quiz's Questions tab. The root cause is a two-stage failure: the qsm_ajax_save_pages() AJAX handler sanitizes user-supplied 'pages' values only with sanitize_text_field() (which strips HTML/PHP tags but does not escape SQL-special characters), then qsm_options_questions_tab_content() at line 143 reconstructs those stored values into an IN() clause via implode() with no $wpdb->prepare() call and no integer casting. No public exploit code has been identified at time of analysis; however, the split-phase attack pattern - where payload planting and execution are decoupled - commonly evades first-order WAF detection and standard code scanning, elevating practical risk beyond the 6.5 CVSS score alone.
SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.
Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authenticated attackers holding at minimum a contributor role to inject persistent JavaScript payloads via the 'question_title' parameter. The injected script executes in the browser of any user who subsequently views a page containing the poisoned quiz, enabling session hijacking, credential harvesting, or unauthorized administrative actions. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; however, the scope change noted in the CVSS vector underscores that impact crosses the boundary from the injecting contributor into every visiting user's browser context.
Second-order SQL injection in Quiz Master Next (QSM) for WordPress through version 11.2.0 allows authenticated attackers holding Author-level access to plant SQL payloads in quiz page data that execute whenever any user - including administrators - views the affected quiz's Questions tab. The root cause is a two-stage failure: the qsm_ajax_save_pages() AJAX handler sanitizes user-supplied 'pages' values only with sanitize_text_field() (which strips HTML/PHP tags but does not escape SQL-special characters), then qsm_options_questions_tab_content() at line 143 reconstructs those stored values into an IN() clause via implode() with no $wpdb->prepare() call and no integer casting. No public exploit code has been identified at time of analysis; however, the split-phase attack pattern - where payload planting and execution are decoupled - commonly evades first-order WAF detection and standard code scanning, elevating practical risk beyond the 6.5 CVSS score alone.