Plugin security history

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 69 vulnerability records associated with Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

69Total records

4Critical

13High

52Medium

0Low

0Informational

69Patched records

0Currently marked unpatched

2015-07-16First disclosure

2026-07-22Latest disclosure

62 of 69CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2016	1	1 records
2019	2	2 records
2020	4	4 records
2021	6	6 records
2022	16	16 records
2023	10	10 records
2024	7	7 records
2025	5	5 records
2026	17	17 records

Severity Breakdown

Severity	Records	Share
Critical	4	5.8%
High	13	18.8%
Medium	52	75.4%

Vulnerability-Type Breakdown

Cross-Site Scripting

25 records36.2%

First: 2019. Latest: 2026.

Missing Authorization

15 records21.7%

First: 2020. Latest: 2026.

SQL Injection

12 records17.4%

First: 2015. Latest: 2026.

CSRF

9 records13%

First: 2016. Latest: 2025.

Other

5 records7.2%

First: 2022. Latest: 2026.

Arbitrary File Upload

2 records2.9%

First: 2020. Latest: 2020.

Information Disclosure

1 record1.4%

First: 2022. Latest: 2022.

Patch Status

Patched: 69
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

11.2.1
11.1.5
11.1.3
11.1.0
11.1.1
11.0.0
10.3.5
10.3.2
10.3.4
10.3.3
10.2.6
10.2.5
10.2.3
9.2.1
9.1.3
9.1.1
9.1.0
9.0.5
9.0.2
8.2.3
8.1.17
8.1.19
8.1.14
8.1.16
8.1.11
8.1.5
8.1.0
8.0.9
8.0.8
8.0.5
7.3.11
7.3.7
7.3.5
7.3.2
7.1.14
7.1.18
7.1.19
7.1.12
7.0.2
7.0.1
7.0.0
6.3.5
6.2.2
4.7.9
4.4.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-11.2.0`	Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection	July 22, 2026	11.2.1	Medium
`*-11.2.0`	Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter	July 15, 2026	11.2.1	Medium
`*-11.1.4`	Quiz And Survey Master <= 11.1.4 - Missing Authorization	July 7, 2026	11.1.5	Medium
`*-11.1.4`	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure	July 2, 2026	11.1.5	Medium
`*-11.1.4`	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action	June 26, 2026	11.1.5	Medium
`*-11.1.2`	Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters	June 5, 2026	11.1.3	Medium
`*-11.1.2`	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting	June 3, 2026	11.1.3	High
`*-11.0.0`	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting	April 23, 2026	11.1.0	High
`*-10.1.0`	Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields	April 16, 2026	11.1.1	Medium
`*-10.3.5`	Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter	March 23, 2026	11.0.0	Medium
`*-10.3.4`	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization	February 5, 2026	10.3.5	Medium
`*-10.3.4`	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference	February 1, 2026	10.3.5	Medium
`*-10.3.1`	Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection	January 28, 2026	10.3.2	Medium
`*-10.3.3`	Quiz And Survey Master <= 10.3.3 - Missing Authorization	January 8, 2026	10.3.4	Medium
`*-10.3.1`	Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads	January 5, 2026	10.3.2	Medium
`*-10.3.1`	Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter	January 5, 2026	10.3.2	Medium
`*-10.3.1`	Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion	January 5, 2026	10.3.2	Medium
`*-10.3.2`	Quiz And Survey Master <= 10.3.2 - Missing Authorization	November 30, 2025	10.3.3	Medium
`*-10.2.5`	Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection	September 3, 2025	10.2.6	High
`*-10.2.4`	Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection	August 14, 2025	10.2.5	Medium
`*-10.2.2`	Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation	July 24, 2025	10.2.3	Medium
`*-9.2.0`	Quiz and Survey Master (QSM) <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting	March 11, 2025	9.2.1	Medium
`*-9.1.2`	Quiz and Survey Master (QSM) <= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting	September 2, 2024	9.1.3	Medium
`*-9.1.0`	Quiz and Survey Master (QSM) <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 5, 2024	9.1.1	Medium
`*-9.0.5`	Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 13, 2024	9.1.0	Medium

Selected source records

Latest Records

MediumCVE-2026-65454

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection

Published: July 22, 2026

Affected versions: *-11.2.0
Patched versions: 11.2.1

Original Wordfence record

MediumCVE-2026-13767

Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter

Published: July 15, 2026

Affected versions: *-11.2.0
Patched versions: 11.2.1

Original Wordfence record

MediumCVE-2026-14821

Quiz And Survey Master <= 11.1.4 - Missing Authorization

Published: July 7, 2026

Affected versions: *-11.1.4
Patched versions: 11.1.5

Original Wordfence record

MediumCVE-2026-9230

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure

Published: July 2, 2026

Affected versions: *-11.1.4
Patched versions: 11.1.5

Original Wordfence record

MediumCVE-2026-9233

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action

Published: June 26, 2026

Affected versions: *-11.1.4
Patched versions: 11.1.5

Original Wordfence record

MediumCVE-2026-6448

Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters

Published: June 5, 2026

Affected versions: *-11.1.2
Patched versions: 11.1.3

Original Wordfence record

HighCVE-2026-48867

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting

Published: June 3, 2026

Affected versions: *-11.1.2
Patched versions: 11.1.3

Original Wordfence record

HighCVE-2026-40787

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting

Published: April 23, 2026

Affected versions: *-11.0.0
Patched versions: 11.1.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-3592

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection

Published: June 6, 2024

Affected versions: *-9.0.1
Patched versions: 9.0.2

Original Wordfence record

Critical

Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload

Published: August 29, 2020

Affected versions: *-7.0.1
Patched versions: 7.0.2

Original Wordfence record

CriticalCVE-2023-28787

Quiz and Survey Master <= 8.1.4 - Unauthenticated SQL Injection

Published: April 16, 2023

Affected versions: *-8.1.4
Patched versions: 8.1.5

Original Wordfence record

CriticalCVE-2020-35949

Quiz and Survey Master <= 7.0.0 - Arbitrary File Upload

Published: August 3, 2020

Affected versions: [*, 7.0.1)
Patched versions: 7.0.1

Original Wordfence record

High

Quiz And Survey Master < 4.4.4 - Multiple SQL Injections

Published: July 16, 2015

Affected versions: [*, 4.4.4)
Patched versions: 4.4.4

Original Wordfence record

HighCVE-2021-24221

Quiz And Survey Master <= 7.1.11 - Authenticated SQL injection via shortcode

Published: March 26, 2021

Affected versions: *-7.1.11
Patched versions: 7.1.12

Original Wordfence record

High

Quiz And Survey Master <= 7.3.10 - Cross-Site Request Forgery

Published: October 23, 2022

Affected versions: *-7.3.10
Patched versions: 7.3.11

Original Wordfence record

HighCVE-2016-11085

Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published: December 15, 2016

Affected versions: [*, 4.7.9)
Patched versions: 4.7.9

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory