These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross Site Scripting (XSS) vulnerability exists in the WordPress Quiz And Survey Master plugin versions up to and including 11.2.7. This issue, identified as CVE-2026-107862, allows for DOM-Based XSS attacks due to improper neutralization of input during web page generation. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
The CVE-2026-97289 vulnerability is a Cross-Site Scripting (XSS) issue in the WordPress Quiz And Survey Master plugin, affecting versions up to 11.2.6. This vulnerability allows for DOM-Based XSS attacks. The CVE record was published on 2026-09-30T12:28:20.861Z and was last modified on 2026-10-09T18:13:00.752Z. Defenders should assess exposure and prioritize updating to a secure version. The vulnerability [truncated]
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at lin [truncated]
CVE-2026-48867 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin versions up to 11.1.2. Defenders should assess exposure, prioritize remediation, and verify inventory for this plugin.
CVE-2026-40787 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability affecting Quiz And Survey Master versions up to 11.0.0. Defenders should assess exposure, prioritize remediation, and verify vendor-provided fixes.
The Quiz and Survey Master plugin for WordPress has a vulnerability allowing unauthorized access and modification of data. This issue, present in all versions up to 10.3.1, enables unauthenticated attackers to view unpublished, private, or password-protected quizzes and submit file responses. The vulnerability is caused by missing capability and status checks on multiple functions. This could allow attack [truncated]
The Quiz and Survey Master plugin for WordPress, versions up to and including 10.3.1, is vulnerable to time-based SQL Injection via the 'is_linking' parameter. This vulnerability allows authenticated attackers with Subscriber-level access and above to append additional SQL queries, potentially leading to sensitive information disclosure from the database. Defenders should assess exposure and implement com [truncated]
The Quiz and Survey Master plugin for WordPress has a vulnerability allowing authenticated attackers with Subscriber-level access to delete quiz results. This issue, tracked as CVE-2025-9294, has a CVSS score of 4.3 and is classified as MEDIUM severity. The vulnerability arises from a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This ov [truncated]