ExpressTech Vulnerabilities and Affected Products

Products

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker13 vulnerabilities
Quiz And Survey Master12 vulnerabilities
Quiz And Survey Master (WordPress plugin)9 vulnerabilities
quiz_and_survey_master8 vulnerabilities
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress3 vulnerabilities
Responsive Menu Pro3 vulnerabilities
Responsive Menu – Create Mobile-Friendly Menu3 vulnerabilities
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker1 vulnerability
Responsive Menu (WordPress plugin)1 vulnerability

ExpressTech vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2022-42883MEDIUM	WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. CWE-200Nov 18, 2022	CVSS5.3v3.1	EPSS0.652%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-40698MEDIUM	WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. CWE-79Nov 18, 2022	CVSS5.4v3.1	EPSS0.419%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-41652MEDIUM	WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. CWE-284Nov 18, 2022	CVSS6.5v3.1	EPSS0.687%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36905MEDIUM	WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress. CWE-79Nov 17, 2022	CVSS5.4v3.1	EPSS0.429%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36906LOW	WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress. CWE-639Nov 3, 2022	CVSS2.7v3.1	EPSS0.525%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36898HIGH	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress. CWE-89Oct 28, 2022	CVSS7.5v3.1	EPSS0.838%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36864LOW	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. CWE-79Oct 28, 2022	CVSS3.4v3.1	EPSS0.424%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36863MEDIUM	WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress. CWE-79Oct 28, 2022	CVSS5.4v3.1	EPSS0.46%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-36865LOW	WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz. CWE-639Sep 30, 2022	CVSS3.8v3.1	EPSS0.434%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX