WordPress quiz-and-survey-master has 19 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-35951 | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as w | critical | 9.9 | <7.0.1 | 7.0.1 |
| CVE-2020-35949 | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers t | critical | 10.0 | <7.0.1 | 7.0.1 |
| CVE-2021-24221 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET paramet | high | 8.8 | <7.1.12 | 7.1.12 |
| CVE-2016-11085 | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the | medium | 6.5 | <4.7.9 | 4.7.9 |
| CVE-2021-24368 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id param | medium | 6.1 | <7.1.18 | 7.1.18 |
| CVE-2022-41652 | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 6.5 | <7.3.11 | 7.3.11 |
| CVE-2022-42883 | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.3 | <=7.3.10 | – |
| CVE-2021-24691 | The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which | medium | 4.8 | <7.3.2 | 7.3.2 |
| CVE-2024-5606 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the | high | 8.8 | <9.0.2 | 9.0.2 |
| CVE-2023-3575 | The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users wit | medium | 5.4 | <8.1.11 | 8.1.11 |
| CVE-2022-40698 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | medium | 5.4 | <7.3.11 | 7.3.11 |
| CVE-2024-6879 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a | medium | 4.7 | <9.1.1 | 9.1.1 |
| CVE-2024-8758 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high pr | medium | 4.8 | <9.1.3 | 9.1.3 |
| CVE-2022-46862 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | <8.0.8 | 8.0.8 |
| CVE-2024-6025 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow co | medium | 5.4 | <9.0.5 | 9.0.5 |
| CVE-2024-4934 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them | medium | 5.5 | <9.0.2 | 9.0.2 |
| CVE-2024-10679 | The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high pr | medium | 6.1 | <9.2.1 | 9.2.1 |
| CVE-2024-6390 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which coul | medium | 5.9 | <9.1.0 | 9.1.0 |
| CVE-2023-26524 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plug | medium | 4.3 | <=8.0.10 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked