CVE-2026-13767

Name of the Vulnerable Software and Affected Versions Quiz Master Next versions prior to 11.2.1

Description An issue exists where authenticated attackers with Author-level access or higher can perform a second-order SQL Injection. This occurs because the qsm ajax save pages() AJAX handler does not sufficiently escape the pages parameter, and the qsm options questions tab content() function fails to use $wpdb->prepare() or integer casting when interpolating stored page IDs into an IN() clause. An attacker can plant a SQL payload that executes when any user, including an administrator, views the Questions tab of a quiz, potentially allowing the extraction of sensitive database information.

Recommendations Update to a version newer than 11.2.0.