5.5
Medium
CVE-2024-4934 The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields…
Description
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Quiz and Survey Master (QSM) 9.0 | earliest → < 9.0.2 | 9.0.2 |
| quiz_and_survey_master 9.0 | earliest → < 9.0.2 | 9.0.2 |
Other CVEs of Quiz and Survey Master (QSM)
The 14 CVEs of Quiz and Survey Master (QSM) →
CVE-2026-79615
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question…
2.7
Low
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the…
2.7
Low
CVE-2026-14825
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before…
2.7
Low
CVE-2026-14824
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before…
4.8
Medium