WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

Quiz maker & survey maker for WordPress. Build quizzes, surveys, exams & assessments with scoring, results pages & lead capture — free & easy.

60Reported vulnerabilities
9.8Highest CVSS score
11.2.4Latest version
40,000+Active installs

What to do now

Update Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker to 11.2.4 or later. 60 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 10, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-0292 High 8.1 0.8% 8.0.8 and earlier 8.0.9 June 9, 2023
CVE-2019-17599 Medium 6.1 1.7% Before 6.3.5 6.3.5 December 13, 2019
CVE-2019-9575 Medium 6.1 1.6% 6.0.4 to 6.0.4 (inclusive) 6.2.2 March 5, 2019
CVE-2023-28787 Critical 9.8 2.0% 8.1.4 and earlier 8.1.5 April 16, 2023
CVE-2023-0291 Critical 9.1 2.0% 8.0.8 and earlier 8.0.9 June 9, 2023
CVE-2022-41652 Critical 9.8 0.7% Before 7.3.11 7.3.11 November 18, 2022
WF-26140315-04c7-4056-a570-865cd4ffe85e Critical 9.8 — 7.0.1 and earlier 7.0.2 August 29, 2020
CVE-2023-26524 High 8.8 0.3% 8.0.10 and earlier 8.1.0 November 13, 2023
CVE-2022-46862 High 8.8 0.4% Before 8.0.8 8.0.8 February 14, 2023
CVE-2021-36906 High 8.8 0.6% 7.3.6 and earlier 7.3.7 November 3, 2022
CVE-2022-0180 High 8.8 0.7% 7.3.5 and earlier 7.3.7 January 12, 2022
WF-c829894f-05b8-4c65-9f3a-3a5d6e212cde High 8.8 — 7.3.10 and earlier 7.3.11 October 23, 2022
WF-3a17b6ad-c778-4677-b5bd-6ffc9b425ba1 High 8.8 — Before 4.4.4 4.4.4 July 16, 2015
CVE-2025-49401 High 8.1 0.4% 10.2.5 and earlier 10.2.6 September 3, 2025
CVE-2022-42883 High 7.5 0.7% 7.3.10 and earlier 7.3.11 November 18, 2022
CVE-2021-36898 High 7.2 0.9% 7.3.4 and earlier 7.3.5 October 28, 2022
CVE-2021-20792 Medium 6.1 3.4% 7.1.13 and earlier 7.1.14 September 13, 2021
CVE-2026-48867 High 7.2 0.2% 11.1.2 and earlier 11.1.3 June 3, 2026
CVE-2026-40787 High 7.2 0.2% 11.0.0 and earlier 11.1.0 April 23, 2026
CVE-2026-15963 Medium 6.5 0.3% 0 to 11.2.1 (inclusive) 11.2.2 August 16, 2026
CVE-2026-11780 Medium 6.4 0.3% 0 to 11.2.1 (inclusive) 11.2.2 August 16, 2026
CVE-2026-65454 Medium 6.5 0.4% 11.2.0 and earlier 11.2.1 July 22, 2026
CVE-2026-13767 Medium 6.5 0.4% 0 to 11.2.0 (inclusive) 11.2.1 July 16, 2026
CVE-2026-2412 Medium 6.5 0.3% 0 to 10.3.5 (inclusive) 11.0.0 March 23, 2026
CVE-2025-67987 Medium 6.5 0.3% 10.3.1 and earlier 10.3.2 January 28, 2026
CVE-2025-9637 Medium 6.5 0.3% Before 10.3.2 10.3.2 January 6, 2026
CVE-2025-9318 Medium 6.5 0.3% Before 10.3.2 10.3.2 January 6, 2026
CVE-2025-55708 Medium 6.5 0.3% 10.2.4 and earlier 10.2.5 August 14, 2025
CVE-2024-3592 Medium 6.5 0.5% Before 9.0.2 9.0.2 June 7, 2024
CVE-2023-47834 Medium 6.4 0.4% 8.1.13 and earlier 8.1.14 November 16, 2023
CVE-2026-14824 Medium 6.4 0.2% 11.2.1 and earlier 11.2.2 July 27, 2026
WF-4b468c0b-88ac-4ea8-97a9-08e206faf0fb Medium 6.4 — Before 7.1.19 7.1.19 June 3, 2021
WF-3f378797-a7a7-4691-8d37-1caef454bb4f Medium 6.4 — 6.4.12 and earlier 7.0.0 July 29, 2020
CVE-2022-40698 Medium 6.1 0.4% Before 7.3.11 7.3.11 November 18, 2022
WF-9c2883e6-2a90-46c7-ba42-cc078e4d1670 Medium 6.1 — 7.1.13 and earlier 7.1.14 August 10, 2021
CVE-2022-0181 Medium 5.4 1.3% 7.3.6 and earlier 7.3.7 January 12, 2022
CVE-2022-0182 Medium 5.4 1.0% 7.3.6 and earlier 7.3.7 January 12, 2022
CVE-2026-5797 Medium 5.3 0.5% 0 to 10.1.0 (inclusive) 11.1.1 April 17, 2026
CVE-2021-36905 Medium 5.4 0.4% Before 7.3.5 7.3.5 November 17, 2022
CVE-2021-36864 Medium 5.4 0.4% 7.3.4 and earlier 7.3.5 October 28, 2022
CVE-2021-36863 Medium 5.4 0.5% 7.3.4 and earlier 7.3.5 October 28, 2022
CVE-2026-25324 Medium 5.3 0.3% 10.3.4 and earlier 10.3.5 February 1, 2026
CVE-2025-63054 Medium 5.3 0.3% 10.3.2 and earlier 10.3.3 November 30, 2025
CVE-2023-51507 Medium 5.3 0.3% 8.1.16 and earlier 8.1.17 December 27, 2023
CVE-2023-37984 Medium 5.3 0.5% 8.1.10 and earlier 8.1.11 July 17, 2023
CVE-2026-6448 Medium 4.9 0.4% 0 to 11.1.2 (inclusive) 11.1.3 June 6, 2026
CVE-2024-27966 Medium 4.4 0.3% 8.2.2 and earlier 8.2.3 March 13, 2024
CVE-2026-79615 Medium 4.3 0.2% Before 11.2.4 11.2.4 August 28, 2026
CVE-2026-14826 Medium 4.3 0.2% 11.2.3 and earlier 11.2.4 August 17, 2026
CVE-2026-14825 Medium 4.3 0.2% 11.2.3 and earlier 11.2.4 August 17, 2026
CVE-2026-14821 Medium 4.3 0.2% 11.1.4 and earlier 11.1.5 July 7, 2026
CVE-2026-9230 Medium 4.3 0.5% 0 to 11.1.4 (inclusive) 11.1.5 July 3, 2026
CVE-2026-9233 Medium 4.3 0.5% 0 to 11.1.4 (inclusive) 11.1.5 June 27, 2026
CVE-2026-25329 Medium 4.3 0.2% 10.3.4 and earlier 10.3.5 February 5, 2026
CVE-2026-24358 Medium 4.3 0.2% 10.3.3 and earlier 10.3.4 January 8, 2026
CVE-2025-9294 Medium 4.3 0.2% Before 10.3.2 10.3.2 January 6, 2026
CVE-2025-6790 Medium 4.3 0.1% 10.2.2 and earlier 10.2.3 July 24, 2025
CVE-2023-51521 Medium 4.3 0.2% 8.1.18 and earlier 8.1.19 December 27, 2023
WF-32173d38-7f85-4e0c-9b4c-38bee2783d77 Medium 4.3 — Before 8.1.15 8.1.16 September 12, 2023
CVE-2021-36865 Medium 4.3 0.4% 7.3.4 and earlier 7.3.5 September 30, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.