CVE-2026-15963

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker versions prior to 11.2.2

Description The plugin is subject to a generic SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with custom-level access or higher can exploit the randon category Quiz Option to append additional queries and extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 11.2.1. As a temporary mitigation, restrict access to the randon category Quiz Option for users with custom-level access.