Veille CVE

Recherche « Unknown Quiz and Survey Master (QSM) »

6 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Quiz and Survey Master (QSM) » ✕
  1. CVE-2026-79615 2.7 Faible

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

  2. CVE-2026-14826 2.7 Faible

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.

  3. CVE-2026-14825 2.7 Faible

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.

  4. CVE-2026-14824 4.8 Moyenne

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

  5. CVE-2026-14821 2.7 Faible

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

  6. CVE-2026-14820 5.3 Moyenne

    Unknown Quiz and Survey Master (QSM)

    The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.