Read the docs

ExpressTech

Records66All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9

Exploited now

ExpressTech records in CISA KEV

No ExpressTech vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Quiz And Survey Master 38 records HIGH Responsive Menu 5 records MEDIUM

Records

38 records in Quiz And Survey Master · all components

TI-2024-05207 CVE-2024-5606 · GHSA-mjgw-jfgq-jq67

Quiz And Survey Master < 9.0.2 - Contributor+ SQLi

Priority HIGH 73

The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection ex…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00591 Published 2024-07-02 Fixed in 9.0.2 CWE-89
TI-2024-05583 CVE-2024-6025 · GHSA-7r5x-34fr-v8qh

Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSS

Priority MEDIUM 62

The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00377 Published 2024-07-11 Fixed in 9.0.5 CWE-79
TI-2024-09897 CVE-2024-10679 · GHSA-h2gq-85xh-8c3c

Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS

Priority MEDIUM 60

The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even w…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00339 Published 2025-03-25 Fixed in 9.2.1 CWE-79
TI-2024-05932 CVE-2024-6390 · GHSA-rg7p-8pgf-fcgw

Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS

Priority MEDIUM 60

The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scr…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00329 Published 2024-08-03 Fixed in 9.1.0 CWE-79
TI-2024-04590 CVE-2024-4934 · GHSA-84r3-5rj8-grqq

Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS

Priority MEDIUM 58

The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the con…

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00351 Published 2024-07-01 Fixed in 9.0.2 CWE-79
TI-2023-03337 CVE-2023-3575 · GHSA-gp25-f9vr-66pv

Quiz And Survey Master < 8.1.11 - Contributor+ Stored XSS

Priority MEDIUM 58

The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00548 Published 2023-08-07 Fixed in 8.1.11
TI-2024-08124 CVE-2024-8758 · GHSA-wx2w-96rx-h8gc

Quiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSS

Priority MEDIUM 55

The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even w…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00396 Published 2024-09-23 Fixed in 9.1.3 CWE-79
TI-2024-06380 CVE-2024-6879 · GHSA-jr8c-49mm-qhr4

Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSS

Priority MEDIUM 55

The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and abov…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00435 Published 2024-08-26 Fixed in 9.1.1 CWE-79
TI-2023-00276 CVE-2023-0291 · GHSA-qfx5-pmrr-ggvv

Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion

Priority MEDIUM 49

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and includin…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02034 Published 2023-06-09 No fix listed CWE-862
TI-2024-03347 CVE-2024-3592 · GHSA-h2qv-f8w8-72wh

SQL injection in ExpressTech Quiz and Survey Master – Easy Quiz and Survey Maker

Priority MEDIUM 43

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insuffic…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00483 Published 2024-06-07 No fix listed CWE-89
TI-2021-06513 CVE-2021-24221 · GHSA-mm94-4mf6-6w8g

Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode

Priority MEDIUM 42

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01893 Published 2021-04-12 Fixed in 7.1.12 CWE-89
TI-2022-00120 CVE-2022-0180 · GHSA-rxq6-93jm-c3wv

Cross-site request forgery in ExpressTech Quiz And Survey Master

Priority LOW 39

Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially c…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00654 Published 2022-01-17 Fixed in 7.3.7 CWE-352
TI-2022-03700 CVE-2022-4032 · GHSA-mpfj-v9c5-37v6

Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer

Priority LOW 33

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that a…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00815 Published 2022-11-29 No fix listed CWE-20
TI-2021-04018 CVE-2021-20792 · GHSA-pv46-7c32-rmg5

Cross-site scripting in ExpressTech Quiz And Survey Master

Priority LOW 33

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02915 Published 2021-08-18 Fixed in 7.1.14 CWE-79
TI-2022-03701 CVE-2022-4033 · GHSA-55x8-c43w-jvpm

Quiz and Survey Master <= 8.0.4 - Improper Input Validation

Priority LOW 31

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00758 Published 2022-11-29 No fix listed CWE-20
Load more
Open these records in search →