CVE-2025-9318 Expresstech CVE debrief

Who should care

Defenders responsible for WordPress installations with the Quiz and Survey Master plugin should assess exposure and implement compensating controls to prevent SQL injection attacks.

Why it matters

The Quiz and Survey Master plugin for WordPress is vulnerable to time-based SQL Injection, allowing authenticated attackers to potentially extract sensitive information from the database. Defenders should prioritize verifying exposure and implementing compensating controls.

• Potential sensitive information disclosure from the database.
• Possible unauthorized data access or modification.
• Required verification of exposure and implementation of compensating controls.
• Need for monitoring and incident response planning.

Technical summary

The Quiz and Survey Master plugin for WordPress, versions up to and including 10.3.1, is vulnerable to time-based SQL Injection via the 'is_linking' parameter. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries into already existing queries, potentially leading to sensitive information disclosure. The vulnerability is caused by insufficient escaping on the user-supplied parameter and a lack of sufficient preparation on the existing SQL query. Defenders should prioritize verifying exposure and implementing compensating controls to prevent SQL injection attacks.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to prevent SQL injection attacks.

Recommended defensive actions

• Verify exposure by checking if the Quiz and Survey Master plugin version is within the affected range (up to 10.3.1).
• Implement compensating controls to prevent SQL injection attacks, such as input validation and sanitization.
• Monitor for suspicious database activity and implement logging and incident response plans.
• Review and update existing security controls to ensure they are effective against this vulnerability.
• Conduct regular security audits to identify and address potential vulnerabilities.
• Implement a Web Application Firewall (WAF) to detect and prevent SQL injection attacks.
• Develop an incident response plan in case of a successful attack.

Evidence notes

The CVE record (CVE-2025-9318) and NVD vulnerability detail page (NVD) provide information on the vulnerability, including its description, CVSS score of 6.5, and affected versions up to 10.3.1. The vulnerability is caused by insufficient escaping on the user-supplied 'is_linking' parameter and a lack of sufficient preparation on the existing SQL query. Defenders should verify exposure by checking the plugin version and implement compensating controls such as input validation and sanitization. The CVE record was published on 2026-01-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.