ExpressTech Vulnerabilities and Affected Products
Vulnerabilities associated with Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress.
Products
Clear product- Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker13 vulnerabilities
- Quiz And Survey Master12 vulnerabilities
- Quiz And Survey Master (WordPress plugin)9 vulnerabilities
- quiz_and_survey_master8 vulnerabilities
- Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress3 vulnerabilities
- Responsive Menu Pro3 vulnerabilities
- Responsive Menu – Create Mobile-Friendly Menu3 vulnerabilities
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker1 vulnerability
- Responsive Menu (WordPress plugin)1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-26524MEDIUM | WordPress Quiz And Survey Master Plugin <= 8.0.10 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions. CWE-352Nov 12, 2023 | CVSS4.3v3.1 | EPSS0.309% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-46862MEDIUM | WordPress Quiz And Survey Master Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions. CWE-352Feb 14, 2023 | CVSS4.3v3.1 | EPSS0.384% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24368MEDIUM | Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link CWE-79Jun 20, 2021 | CVSS6.1v3.1 | EPSS0.827% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |