# Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

> Quiz maker & survey maker for WordPress. Build quizzes, surveys, exams & assessments with scoring, results pages & lead capture — free & easy.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:34 UTC.

## Facts (WordPress.org)

- Slug: `quiz-master-next`
- Author: ExpressTech Systems
- Version: 11.3.1
- Active installs: 40,000+
- Last update: 2026-11-11 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.0, PHP 5.4
- Tags: exam, quiz, quiz maker, survey, survey maker
- Page: https://wordpress.org/plugins/quiz-master-next/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Inaccessible ↔ Accessible, Paywalled ↔ Generous, Locked in ↔ Portable, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-11-12 MEDIUM: Injection (up to 11.3.0). CVE-2026-125786, https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve
- 2026-11-12 MEDIUM: Missing Authorization (up to 11.3.0). CVE-2026-125787, https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve
- 2026-11-12 MEDIUM: Authenticated (Contributor+) SQL Injection via 'qpages' Parameter (up to 11.2.9). CVE-2026-116509, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=api-prod
- 2026-11-06 MEDIUM: Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter (up to 11.2.7). CVE-2026-103917, https://www.wordfence.com/threat-intel/vulnerabilities/id/020209b3-2175-4509-836a-8a60ed4f4b15?source=api-prod
- 2026-10-19 HIGH: Authenticated (Contributor+) PHP Object Injection (up to 11.2.7). CVE-2026-111408, https://www.wordfence.com/threat-intel/vulnerabilities/id/60ed3820-0ef3-415c-a742-d4f9f42418a3?source=api-prod
- 2026-10-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 11.2.7). CVE-2026-107862, https://www.wordfence.com/threat-intel/vulnerabilities/id/9c5dfda6-a19b-46cb-8e8f-f3a84ea30809?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter (up to 11.2.6). CVE-2026-96558, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e344974-08c8-45a5-a0f4-3780ce00928b?source=api-prod
- 2026-10-09 HIGH: Authenticated (Contributor+) PHP Object Injection (up to 11.2.7). CVE-2026-104392, https://www.wordfence.com/threat-intel/vulnerabilities/id/1f55296d-f459-4bd4-979e-5286cc489159?source=api-prod
- 2026-10-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 11.2.7). CVE-2026-104391, https://www.wordfence.com/threat-intel/vulnerabilities/id/06039853-18fb-4391-b777-53ca1e4f12e9?source=api-prod
- 2026-09-30 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 11.2.6). CVE-2026-97289, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1256966-0b0f-43d1-a168-20b8851e4aae?source=api-prod
- 2026-09-11 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 11.2.5). CVE-2026-62140, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6763a3-6773-41fe-b7fd-f21c34963bd8?source=api-prod
- 2026-08-28 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (before 11.2.4). CVE-2026-79615, https://www.wordfence.com/threat-intel/vulnerabilities/id/ecdb7f0e-aacb-4e79-a041-e9e060b61573?source=api-prod
- 2026-08-19 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (up to 11.2.3). CVE-2026-14825, https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c37e2-c9f7-4a07-94d0-51298d98ff80?source=api-prod
- 2026-08-19 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (up to 11.2.3). CVE-2026-14826, https://www.wordfence.com/threat-intel/vulnerabilities/id/0767e5ef-477f-4b0c-a86e-6298614c9777?source=api-prod
- 2026-08-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter (up to 11.2.1). CVE-2026-11780, https://www.wordfence.com/threat-intel/vulnerabilities/id/66334c29-c9d6-48b0-8d6b-bae588da0331?source=api-prod
- 2026-08-16 MEDIUM: Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option (up to 11.2.1). CVE-2026-15963, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1de31ae-4095-4863-9971-9de45c36f5a0?source=api-prod
- 2026-08-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 11.2.1). CVE-2026-14824, https://www.wordfence.com/threat-intel/vulnerabilities/id/d683c895-0532-4ffe-a4db-13d9c17426c7?source=api-prod
- 2026-07-28 MEDIUM: Missing Authorization (up to 11.1.4). CVE-2026-14821, https://www.wordfence.com/threat-intel/vulnerabilities/id/86c8f14a-bb64-41bb-9ab7-dd86f122dc4c?source=api-prod
- 2026-07-27 MEDIUM: does not implement rate limiting or standard failed-login auditing ... (before 11.1.3). CVE-2026-14820, https://wpscan.com/vulnerability/22af8c73-8147-4205-8285-a35881f2d041/
- 2026-07-23 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 11.2.0). CVE-2026-65454, https://www.wordfence.com/threat-intel/vulnerabilities/id/316e98ba-c497-416e-9286-1d67daeb3fd4?source=api-prod
- 2026-07-16 MEDIUM: Authenticated (Custom+) SQL Injection via 'pages' Parameter (up to 11.2.0). CVE-2026-13767, https://www.wordfence.com/threat-intel/vulnerabilities/id/63fec549-09e0-4d4e-ae41-128ce0669501?source=api-prod
- 2026-07-03 MEDIUM: Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure (up to 11.1.4). CVE-2026-9230, https://www.wordfence.com/threat-intel/vulnerabilities/id/49c66f9e-e58c-435b-9bb0-d6b66261e789?source=api-prod
- 2026-06-27 MEDIUM: Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action (up to 11.1.4). CVE-2026-9233, https://www.wordfence.com/threat-intel/vulnerabilities/id/38db911b-cad5-4c8c-b0a4-70dc543b4591?source=api-prod
- 2026-06-15 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 11.0.0). CVE-2026-40787, https://www.wordfence.com/threat-intel/vulnerabilities/id/855a06dc-5e92-4354-b4ab-456a224e2903?source=api-prod
- 2026-06-15 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 11.1.2). CVE-2026-48867, https://www.wordfence.com/threat-intel/vulnerabilities/id/82f0b4c3-d0fb-4f3c-b8aa-c5f5ce6c3f16?source=api-prod
- 2026-06-06 MEDIUM: Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters (up to 11.1.2). CVE-2026-6448, https://www.wordfence.com/threat-intel/vulnerabilities/id/d230b781-e208-4e66-b8ed-aba72db8d8dc?source=api-prod
- 2026-04-17 MEDIUM: Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields (up to 10.1.0). CVE-2026-5797, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2aa33cc-c1c4-42d4-9c2f-54648426ee4b?source=api-prod
- 2026-03-23 MEDIUM: Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter (up to 10.3.5). CVE-2026-2412, https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=api-prod
- 2026-02-05 MEDIUM: Missing Authorization (up to 10.3.4). CVE-2026-25329, https://www.wordfence.com/threat-intel/vulnerabilities/id/2368e46a-022c-4829-80f1-7d010e8587ed?source=api-prod
- 2026-02-01 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 10.3.4). CVE-2026-25324, https://www.wordfence.com/threat-intel/vulnerabilities/id/a67ab966-c179-4ea6-bf8c-bc22f9b4644b?source=api-prod
- 2026-01-28 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 10.3.1). CVE-2025-67987, https://www.wordfence.com/threat-intel/vulnerabilities/id/44e9e7b5-6d60-4c2b-b29b-1a856dc86b41?source=api-prod
- 2026-01-08 MEDIUM: Missing Authorization (up to 10.3.3). CVE-2026-24358, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b949792-7b04-4174-9b86-b2ad259017fa?source=api-prod
- 2026-01-05 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion (up to 10.3.1). CVE-2025-9294, https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=api-prod
- 2026-01-05 MEDIUM: Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads (up to 10.3.1). CVE-2025-9637, https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=api-prod
- 2026-01-05 MEDIUM: Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter (up to 10.3.1). CVE-2025-9318, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=api-prod
- 2025-11-30 MEDIUM: Missing Authorization (up to 10.3.2). CVE-2025-63054, https://www.wordfence.com/threat-intel/vulnerabilities/id/e8e6ee6f-b918-4a8c-82ea-4761f2bcbc43?source=api-prod
- 2025-09-03 HIGH: Unauthenticated PHP Object Injection (up to 10.2.5). CVE-2025-49401, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e087ed4-6f40-4a00-9cdb-1453ac298188?source=api-prod
- 2025-08-14 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 10.2.4). CVE-2025-55708, https://www.wordfence.com/threat-intel/vulnerabilities/id/f89737cf-90f0-4d85-a7b3-f633047eb93c?source=api-prod
- 2025-07-24 MEDIUM: Cross-Site Request Forgery to Template Creation (up to 10.2.2). CVE-2025-6790, https://www.wordfence.com/threat-intel/vulnerabilities/id/42b77d66-8519-4e7e-b253-fefac581df4b?source=api-prod
- 2025-03-11 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 9.2.0). CVE-2024-10679, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3022556-3c37-45d7-809a-4e991ad9e0ea?source=api-prod
- 2024-09-02 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 9.1.2). CVE-2024-8758, https://www.wordfence.com/threat-intel/vulnerabilities/id/47f668b0-8165-4ce8-97cc-b674e708c2eb?source=api-prod
- 2024-08-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 9.1.0). CVE-2024-6879, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a87f0a2-42b0-4536-b4d1-83a9f6ed4262?source=api-prod
- 2024-07-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 9.0.5). CVE-2024-6390, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa25e1d2-65eb-450a-967b-3c003fea3464?source=api-prod
- 2024-07-02 HIGH: SQL Injection (before 9.0.2). CVE-2024-5606, https://wpscan.com/vulnerability/e3eee6bc-1f69-4be1-b323-0c9b5fe7535e/
- 2024-06-20 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 9.0.4). CVE-2024-6025, https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd6c562-3c1e-46a3-bd02-bb587d8e6c76?source=api-prod
- 2024-06-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 9.0.1). CVE-2024-4934, https://www.wordfence.com/threat-intel/vulnerabilities/id/10b47054-29cc-4859-bdfc-4dde1437c037?source=api-prod
- 2024-06-06 CRITICAL: Authenticated (Contributor+) SQL Injection (up to 9.0.1). CVE-2024-3592, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc085413-db43-43e3-9b60-aeb341eed4e1?source=api-prod
- 2024-03-13 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 8.2.2). CVE-2024-27966, https://www.wordfence.com/threat-intel/vulnerabilities/id/e31d8218-5e04-44a1-89aa-f93e9677680b?source=api-prod
- 2023-12-27 MEDIUM: Cross-Site Request Forgery (up to 8.1.18). CVE-2023-51521, https://www.wordfence.com/threat-intel/vulnerabilities/id/4cfdbf80-3733-4d5c-9bc6-01e543ee08b1?source=api-prod
- 2023-12-27 MEDIUM: Missing Authorization (up to 8.1.16). CVE-2023-51507, https://www.wordfence.com/threat-intel/vulnerabilities/id/89ee5d27-9123-4fd2-94f8-4395db5663ec?source=api-prod
- 2023-11-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 8.1.13). CVE-2023-47834, https://www.wordfence.com/threat-intel/vulnerabilities/id/5c482b6e-ce1e-46e2-8847-10c485594448?source=api-prod
- 2023-09-12 MEDIUM: Cross-Site Request Forgery via 'display_results' (before 8.1.15). WF-32173d38-7f85-4e0c-9b4c-38bee2783d77, https://www.wordfence.com/threat-intel/vulnerabilities/id/32173d38-7f85-4e0c-9b4c-38bee2783d77?source=api-prod
- 2023-07-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title (up to 8.1.10). CVE-2023-3575, https://www.wordfence.com/threat-intel/vulnerabilities/id/19cb39d4-f2b4-4f94-8896-ba714567e1ed?source=api-prod
- 2023-07-17 MEDIUM: Excessive Quiz Attempts (up to 8.1.10). CVE-2023-37984, https://www.wordfence.com/threat-intel/vulnerabilities/id/80399759-88dd-478d-a20e-04e8750e12c4?source=api-prod
- 2023-04-16 CRITICAL: Unauthenticated SQL Injection (up to 8.1.4). CVE-2023-28787, https://www.wordfence.com/threat-intel/vulnerabilities/id/b29dcd7a-a0bc-4983-85ba-6ebf2c405ceb?source=api-prod
- 2023-02-28 MEDIUM: Cross-Site Request Forgery to Quiz Restoration (up to 8.0.10). CVE-2023-26524, https://www.wordfence.com/threat-intel/vulnerabilities/id/9af36edd-4520-4afc-8d3a-c9a96659ddf8?source=api-prod
- 2023-02-15 HIGH: Unauthenticated Arbitrary Media Deletion (up to 8.0.8). CVE-2023-0291, https://www.wordfence.com/threat-intel/vulnerabilities/id/68110321-db1a-4634-98cd-0afd3ec933b8?source=api-prod
- 2023-02-08 MEDIUM: Cross-Site Request Forgery to Arbitrary Media Deletion (up to 8.0.8). CVE-2023-0292, https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e6d27-7f6b-4bec-b653-c2024504f427?source=api-prod
- 2022-12-16 MEDIUM: Cross-Site Request Forgery (up to 8.0.7). CVE-2022-46862, https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc4a77-0d81-4d90-9a43-cc4d3055e39c?source=api-prod
- 2022-11-29 HIGH: Unauthenticated iFrame Injection via Paragraph and Short Answer (up to 8.0.4). CVE-2022-4032, https://www.wordfence.com/threat-intel/vulnerabilities/id/b901b3f8-8bbd-42ef-8e0c-de6d09c4950f?source=api-prod
- 2022-11-16 MEDIUM: Improper Input Validation (up to 8.0.4). CVE-2022-4033, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5cc779-c7de-42e6-a812-5c0539067b8c?source=api-prod
- 2022-10-23 HIGH: Cross-Site Request Forgery (up to 7.3.10). WF-c829894f-05b8-4c65-9f3a-3a5d6e212cde, https://www.wordfence.com/threat-intel/vulnerabilities/id/c829894f-05b8-4c65-9f3a-3a5d6e212cde?source=api-prod
- 2022-10-21 HIGH: Authenticated (Administrator+) SQL Injection (up to 7.3.4). CVE-2021-36898, https://www.wordfence.com/threat-intel/vulnerabilities/id/2085c9a3-1cc7-4750-875e-d20c7f94bb78?source=api-prod
- 2022-10-21 MEDIUM: Insecure Direct Object Reference (up to 7.3.6). CVE-2021-36906, https://www.wordfence.com/threat-intel/vulnerabilities/id/332c0829-316d-4037-8c50-02d6c92cdb10?source=api-prod
- 2022-10-21 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 7.3.10). CVE-2022-40698, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d76a21c-bb79-4183-99ea-a07c18dfa180?source=api-prod
- 2022-10-21 MEDIUM: Reflected Cross-Site Scripting (up to 7.3.4). CVE-2021-36864, https://www.wordfence.com/threat-intel/vulnerabilities/id/5113b58b-7d2e-40cd-8669-a5597321106f?source=api-prod
- 2022-10-21 MEDIUM: Missing Authorization (up to 7.3.10). CVE-2022-41652, https://www.wordfence.com/threat-intel/vulnerabilities/id/64584fcd-be84-4d40-bfa8-e6131d0afd58?source=api-prod
- 2022-10-21 MEDIUM: Multiple Authenticated (Contributor+) Stored Cross-Site Scripting (up to 7.3.4). CVE-2021-36905, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d849eda-4c61-47e2-af7c-59a57fffab65?source=api-prod
- 2022-10-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 7.3.4). CVE-2021-36863, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3fb4d-985f-4fb7-bcf1-523792d8dac6?source=api-prod
- 2022-10-21 MEDIUM: Sensitive Information Disclosure (up to 7.3.10). CVE-2022-42883, https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa4b7b9-ea5b-46a1-847e-027bcb1fa5a6?source=api-prod
- 2022-09-29 MEDIUM: Insecure Direct Object Reference (up to 7.3.4). CVE-2021-36865, https://www.wordfence.com/threat-intel/vulnerabilities/id/6975e84e-06ab-41b1-ae39-64685a878d15?source=api-prod
- 2022-01-12 MEDIUM: Stored Cross-Site Scripting (up to 7.3.6). CVE-2022-0182, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1203ce-7582-447f-b011-905b274e1e20?source=api-prod
- 2022-01-12 HIGH: Cross-Site Request Forgery (up to 7.3.5). CVE-2022-0180, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c88c5a-ea87-4aab-a0ce-8246e5cb540a?source=api-prod
- 2022-01-12 MEDIUM: Reflected Cross-Site Scripting (up to 7.3.6). CVE-2022-0181, https://www.wordfence.com/threat-intel/vulnerabilities/id/f55a9d35-596c-4207-be11-ade1127df369?source=api-prod
- 2021-09-13 MEDIUM: Admin+ Stored Cross-Site Scripting (up to 7.3.1). CVE-2021-24691, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ed659-0590-411f-9017-f695c9c2f322?source=api-prod
- 2021-09-13 MEDIUM: Cross-Site Scripting (up to 7.1.13). CVE-2021-20792, https://www.wordfence.com/threat-intel/vulnerabilities/id/fca4040d-3c6c-4e31-9bed-d1b6bf5b2bed?source=api-prod
- 2021-08-10 MEDIUM: SQL Injection (up to 7.1.13). WF-9c2883e6-2a90-46c7-ba42-cc078e4d1670, https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2883e6-2a90-46c7-ba42-cc078e4d1670?source=api-prod
- 2021-06-03 MEDIUM: Cross-Site Scripting (before 7.1.19). WF-4b468c0b-88ac-4ea8-97a9-08e206faf0fb, https://www.wordfence.com/threat-intel/vulnerabilities/id/4b468c0b-88ac-4ea8-97a9-08e206faf0fb?source=api-prod
- 2021-06-03 MEDIUM: Reflected Cross-Site Scripting (up to 7.1.17). CVE-2021-24368, https://www.wordfence.com/threat-intel/vulnerabilities/id/d5ef3350-3eec-48b7-9241-5d2ce25555f0?source=api-prod
- 2021-03-26 HIGH: Authenticated SQL injection via shortcode (up to 7.1.11). CVE-2021-24221, https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd58f59-09c2-417c-89ea-5906d413288c?source=api-prod
- 2020-08-29 CRITICAL: Arbitrary File Upload (up to 7.0.1). WF-26140315-04c7-4056-a570-865cd4ffe85e, https://www.wordfence.com/threat-intel/vulnerabilities/id/26140315-04c7-4056-a570-865cd4ffe85e?source=api-prod
- 2020-08-03 HIGH: Unauthenticated Arbitrary File Deletion (before 7.0.1). CVE-2020-35951, https://www.wordfence.com/threat-intel/vulnerabilities/id/18458883-6cca-46d1-8437-4e646f4eafda?source=api-prod
- 2020-08-03 CRITICAL: Arbitrary File Upload (before 7.0.1). CVE-2020-35949, https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd93c33-4672-4914-b052-7bea283ef60c?source=api-prod
- 2020-07-29 MEDIUM: Stored Cross-Site Scripting (up to 6.4.12). WF-3f378797-a7a7-4691-8d37-1caef454bb4f, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f378797-a7a7-4691-8d37-1caef454bb4f?source=api-prod
- 2019-11-13 MEDIUM: Reflected Cross-Site Scripting (up to 6.3.4). CVE-2019-17599, https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0025dc-a072-4e01-bea8-6e93948f00d8?source=api-prod
- 2019-03-05 MEDIUM: Cross-Site Scripting (up to 6.2.1). CVE-2019-9575, https://www.wordfence.com/threat-intel/vulnerabilities/id/d94bcbf7-c20e-4b04-b4de-f68f9a793b73?source=api-prod
- 2016-12-15 HIGH: Cross-Site Request Forgery to Stored Cross-Site Scripting (before 4.7.9). CVE-2016-11085, https://www.wordfence.com/threat-intel/vulnerabilities/id/ececa0ea-3d44-4b1b-b962-809a8b24c890?source=api-prod
- 2015-07-16 HIGH: Multiple SQL Injections (before 4.4.4). WF-3a17b6ad-c778-4677-b5bd-6ffc9b425ba1, https://www.wordfence.com/threat-intel/vulnerabilities/id/3a17b6ad-c778-4677-b5bd-6ffc9b425ba1?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=quiz-master-next · HTML: https://todaywp.com/plugins/quiz-master-next