The Quiz and Survey Master (QSM) plugin for WordPress is a popular tool for creating interactive quizzes and surveys. However, a significant security flaw has been identified that could put websites using this plugin at risk. This vulnerability, known as SQL Injection, allows unauthorized access to sensitive information stored in your website’s database.
This issue specifically affects the `is_linking` parameter within the plugin, where attackers can craft special requests to trick the database into revealing data it shouldn’t. The problem stems from how the plugin handles user-provided information, lacking proper checks and preparation before executing database queries.
If exploited, an attacker with even basic authenticated access (like a Subscriber-level user) could potentially extract confidential data. This could include user details, quiz results, survey responses, or other vital information from your WordPress site’s database.
CVE Details
The vulnerability is tracked under **CVE-2025-9318**.
**Product:** Quiz and Survey Master (QSM) plugin for WordPress
**Published Date:** January 6, 2026
**Severity:** Medium (CVSS Score 6.5)
**Status:** Analyzed
Affected Products
The **Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress** is impacted. This vulnerability affects all versions of the plugin up to, and including, **10.3.1**. If you are running any version within this range, your website is potentially at risk.
Current Status
The vulnerability has been **Analyzed**, meaning it has been reviewed and confirmed. Webmasters and developers should take immediate action to address this identified risk.
Severity Level
Rated with a **Medium** severity level (CVSS Score of 6.5), this vulnerability indicates a moderate risk. While it requires an authenticated attacker (meaning someone needs to be logged into your site, even with low-level privileges), the potential impact of data extraction is significant. Medium severity vulnerabilities should not be ignored, as they can still lead to serious breaches if left unpatched.
Possible Solutions
The most critical step to protect your WordPress site is to **update the Quiz and Survey Master plugin immediately**. Since the vulnerability affects versions up to and including 10.3.1, you should update to the **latest available version** that is greater than 10.3.1. Developers often release patched versions quickly once a vulnerability is disclosed. Always ensure your plugins are kept up-to-date to receive the latest security fixes.
Additionally, consider these general security best practices:
- Regularly back up your WordPress website.
- Use strong, unique passwords for all user accounts.
- Limit user privileges to the absolute minimum required.
- Employ a robust Web Application Firewall (WAF) to help detect and block malicious requests.
Staying vigilant about plugin updates and overall WordPress security is essential to safeguard your website and its data from potential threats.
References
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php#L533
https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=cve
