CVE-2026-15963
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.2.1 is vulnerable to generic SQL Injection via the 'randon_category' quiz option. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access to append additional SQL queries to extract sensitive information.
Risk Assessment
The organization may face data leakage from the WordPress database. Attackers with low privileges can access confidential information.
Recommendation
Update the Quiz and Survey Master plugin to the latest version. Restrict account privileges and monitor database activity.
Original NVD description (English source)
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.