Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker vulnerabilities
Plugin slug quiz-master-next · 83 known vulnerabilities · latest disclosed 2026-11-06 · WordPress.org page
Every listed vulnerability has a fix. Version 11.2.8 or later is not affected by any of them. If your site runs an older version, update it.
21 of 83 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 6.5 | <= 11.2.7 | 11.2.8 | CVE-2026-103917 | 2026-11-06 | Advisory |
| High 7.5 | <= 11.2.7 | 11.2.8 | CVE-2026-111408 | 2026-10-17 | Advisory |
| Medium 6.4 | <= 11.2.7 | 11.2.8 | CVE-2026-107862 | 2026-10-12 | Advisory |
| High 7.2 | <= 11.2.6 | 11.2.7 | CVE-2026-96558 | 2026-10-09 | Advisory |
| Medium 6.4 | <= 11.2.7 | 11.2.8 | CVE-2026-104391 | 2026-10-07 | Advisory |
| High 7.5 | <= 11.2.7 | 11.2.8 | CVE-2026-104392 | 2026-10-07 | Advisory |
| High 7.2 | <= 11.2.6 | 11.2.7 | CVE-2026-97289 | 2026-09-30 | Advisory |
| Medium 5.3 | <= 11.2.5 | 11.2.6 | CVE-2026-62140 | 2026-09-10 | Advisory |
| Medium 4.3 | < 11.2.4 | 11.2.4 | CVE-2026-79615 | 2026-08-28 | Advisory |
| Medium 4.3 | <= 11.2.3 | 11.2.4 | CVE-2026-14826 | 2026-08-17 | Advisory |
| Medium 4.3 | <= 11.2.3 | 11.2.4 | CVE-2026-14825 | 2026-08-17 | Advisory |
| Medium 6.5 | <= 11.2.1 | 11.2.2 | CVE-2026-15963 | 2026-08-15 | Advisory |
| Medium 6.4 | <= 11.2.1 | 11.2.2 | CVE-2026-11780 | 2026-08-15 | Advisory |
| Medium 6.4 | <= 11.2.1 | 11.2.2 | CVE-2026-14824 | 2026-07-27 | Advisory |
| Medium 6.5 | <= 11.2.0 | 11.2.1 | CVE-2026-65454 | 2026-07-22 | Advisory |
| Medium 6.5 | <= 11.2.0 | 11.2.1 | CVE-2026-13767 | 2026-07-15 | Advisory |
| Medium 4.3 | <= 11.1.4 | 11.1.5 | CVE-2026-14821 | 2026-07-07 | Advisory |
| Medium 4.3 | <= 11.1.4 | 11.1.5 | CVE-2026-9230 | 2026-07-02 | Advisory |
| Medium 4.3 | <= 11.1.4 | 11.1.5 | CVE-2026-9233 | 2026-06-26 | Advisory |
| Medium 4.9 | <= 11.1.2 | 11.1.3 | CVE-2026-6448 | 2026-06-05 | Advisory |
| High 7.2 | <= 11.1.2 | 11.1.3 | CVE-2026-48867 | 2026-06-03 | Advisory |
| High 7.2 | <= 11.0.0 | 11.1.0 | CVE-2026-40787 | 2026-04-23 | Advisory |
| Medium 5.3 | <= 10.1.0 | 11.1.1 | CVE-2026-5797 | 2026-04-16 | Advisory |
| Medium 6.5 | <= 10.3.5 | 11.0.0 | CVE-2026-2412 | 2026-03-23 | Advisory |
| Medium 4.3 | <= 10.3.4 | 10.3.5 | CVE-2026-25329 | 2026-02-05 | Advisory |
| Medium 5.3 | <= 10.3.4 | 10.3.5 | CVE-2026-25324 | 2026-02-01 | Advisory |
| Medium 6.5 | <= 10.3.1 | 10.3.2 | CVE-2025-67987 | 2026-01-28 | Advisory |
| Medium 4.3 | <= 10.3.3 | 10.3.4 | CVE-2026-24358 | 2026-01-08 | Advisory |
| Medium 6.5 | <= 10.3.1 | 10.3.2 | CVE-2025-9637 | 2026-01-05 | Advisory |
| Medium 6.5 | <= 10.3.1 | 10.3.2 | CVE-2025-9318 | 2026-01-05 | Advisory |
| Medium 4.3 | <= 10.3.1 | 10.3.2 | CVE-2025-9294 | 2026-01-05 | Advisory |
| Medium 5.3 | <= 10.3.2 | 10.3.3 | CVE-2025-63054 | 2025-11-30 | Advisory |
| High 8.1 | <= 10.2.5 | 10.2.6 | CVE-2025-49401 | 2025-09-03 | Advisory |
| Medium 6.5 | <= 10.2.4 | 10.2.5 | CVE-2025-55708 | 2025-08-14 | Advisory |
| Medium 4.3 | <= 10.2.2 | 10.2.3 | CVE-2025-6790 | 2025-07-24 | Advisory |
| Medium 4.4 | <= 9.2.0 | 9.2.1 | CVE-2024-10679 | 2025-03-11 | Advisory |
| Medium 4.4 | <= 9.1.2 | 9.1.3 | CVE-2024-8758 | 2024-09-02 | Advisory |
| Medium 6.4 | <= 9.1.0 | 9.1.1 | CVE-2024-6879 | 2024-08-05 | Advisory |
| Medium 6.4 | <= 9.0.5 | 9.1.0 | CVE-2024-6390 | 2024-07-13 | Advisory |
| Medium 6.4 | <= 9.0.4 | 9.0.5 | CVE-2024-6025 | 2024-06-20 | Advisory |
| Medium 6.4 | <= 9.0.1 | 9.0.2 | CVE-2024-4934 | 2024-06-10 | Advisory |
| Critical 9.9 | <= 9.0.1 | 9.0.2 | CVE-2024-3592 | 2024-06-06 | Advisory |
| Medium 4.4 | <= 8.2.2 | 8.2.3 | CVE-2024-27966 | 2024-03-13 | Advisory |
| Medium 4.3 | <= 8.1.18 | 8.1.19 | CVE-2023-51521 | 2023-12-27 | Advisory |
| Medium 5.3 | <= 8.1.16 | 8.1.17 | CVE-2023-51507 | 2023-12-27 | Advisory |
| Medium 6.4 | <= 8.1.13 | 8.1.14 | CVE-2023-47834 | 2023-11-16 | Advisory |
| Medium 4.3 | < 8.1.15 | 8.1.16 | none | 2023-09-12 | Advisory |
| Medium 6.4 | <= 8.1.10 | 8.1.11 | CVE-2023-3575 | 2023-07-17 | Advisory |
| Medium 5.3 | <= 8.1.10 | 8.1.11 | CVE-2023-37984 | 2023-07-17 | Advisory |
| Critical 9.8 | <= 8.1.4 | 8.1.5 | CVE-2023-28787 | 2023-04-16 | Advisory |
| Medium 4.3 | <= 8.0.10 | 8.1.0 | CVE-2023-26524 | 2023-02-28 | Advisory |
| High 7.2 | <= 8.0.8 | 8.0.9 | CVE-2023-0291 | 2023-02-15 | Advisory |
| Medium 5.4 | <= 8.0.8 | 8.0.9 | CVE-2023-0292 | 2023-02-08 | Advisory |
| Medium 4.3 | <= 8.0.7 | 8.0.8 | CVE-2022-46862 | 2022-12-16 | Advisory |
| High 7.2 | <= 8.0.4 | 8.0.5 | CVE-2022-4032 | 2022-11-29 | Advisory |
| Medium 5.3 | <= 8.0.4 | 8.0.5 | CVE-2022-4033 | 2022-11-16 | Advisory |
| High 8.8 | <= 7.3.10 | 7.3.11 | none | 2022-10-23 | Advisory |
| High 7.2 | <= 7.3.4 | 7.3.5 | CVE-2021-36898 | 2022-10-21 | Advisory |
| Medium 5.4 | <= 7.3.6 | 7.3.7 | CVE-2021-36906 | 2022-10-21 | Advisory |
| High 7.2 | <= 7.3.10 | 7.3.11 | CVE-2022-40698 | 2022-10-21 | Advisory |
| Medium 6.1 | <= 7.3.4 | 7.3.5 | CVE-2021-36864 | 2022-10-21 | Advisory |
| Medium 4.3 | <= 7.3.10 | 7.3.11 | CVE-2022-41652 | 2022-10-21 | Advisory |
| Medium 6.4 | <= 7.3.4 | 7.3.5 | CVE-2021-36905 | 2022-10-21 | Advisory |
| Medium 6.4 | <= 7.3.4 | 7.3.5 | CVE-2021-36863 | 2022-10-21 | Advisory |
| Medium 5.3 | <= 7.3.10 | 7.3.11 | CVE-2022-42883 | 2022-10-21 | Advisory |
| Medium 5.4 | <= 7.3.4 | 7.3.5 | CVE-2021-36865 | 2022-09-29 | Advisory |
| Medium 5.4 | <= 7.3.6 | 7.3.7 | CVE-2022-0182 | 2022-01-12 | Advisory |
| High 8.8 | <= 7.3.5 | 7.3.7 | CVE-2022-0180 | 2022-01-12 | Advisory |
| Medium 5.4 | <= 7.3.6 | 7.3.7 | CVE-2022-0181 | 2022-01-12 | Advisory |
| Medium 4.8 | <= 7.3.1 | 7.3.2 | CVE-2021-24691 | 2021-09-13 | Advisory |
| Medium 6.1 | <= 7.1.13 | 7.1.14 | CVE-2021-20792 | 2021-09-13 | Advisory |
| Medium 6.1 | <= 7.1.13 | 7.1.14 | none | 2021-08-10 | Advisory |
| Medium 6.4 | < 7.1.19 | 7.1.19 | none | 2021-06-03 | Advisory |
| Medium 6.1 | <= 7.1.17 | 7.1.18 | CVE-2021-24368 | 2021-06-03 | Advisory |
| High 8.8 | <= 7.1.11 | 7.1.12 | CVE-2021-24221 | 2021-03-26 | Advisory |
| Critical 9.8 | <= 7.0.1 | 7.0.2 | none | 2020-08-29 | Advisory |
| High 8.2 | < 7.0.1 | 7.0.1 | CVE-2020-35951 | 2020-08-03 | Advisory |
| Critical 9.8 | < 7.0.1 | 7.0.1 | CVE-2020-35949 | 2020-08-03 | Advisory |
| Medium 6.4 | <= 6.4.12 | 7.0.0 | none | 2020-07-29 | Advisory |
| Medium 6.1 | <= 6.3.4 | 6.3.5 | CVE-2019-17599 | 2019-11-13 | Advisory |
| Medium 6.1 | <= 6.2.1 | 6.2.2 | CVE-2019-9575 | 2019-03-05 | Advisory |
| High 8.8 | < 4.7.9 | 4.7.9 | CVE-2016-11085 | 2016-12-15 | Advisory |
| High 8.8 | < 4.4.4 | 4.4.4 | none | 2015-07-16 | Advisory |
Check if a site is affected
Enter a site address to see which version of Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin safe to use?
All 83 known issues are fixed in current versions (11.2.8 or later). Keeping it updated is what matters.
How do I check which version of Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome