2.7
Low
CVE-2026-79615 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question…
Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Quiz and Survey Master (QSM) 11.2 | earliest → < 11.2.4 | 11.2.4 |
Other CVEs of Quiz and Survey Master (QSM)
The 14 CVEs of Quiz and Survey Master (QSM) →
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the…
2.7
Low
CVE-2026-14825
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before…
2.7
Low
CVE-2026-14824
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before…
4.8
Medium
CVE-2026-14821
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting…
2.7
Low