Does Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker have any unpatched vulnerabilities?

No published vulnerabilities and no findings under coordinated disclosure as of the latest data update. Always keep the plugin updated to the latest version.

Is Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker compatible with WordPress 7.0.2?

According to WordPress.org data, Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker 11.2.2 has been tested up to WordPress 7.0.2. Check the plugin's changelog for the latest compatibility information.

Is Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker compatible with PHP 5.4+?

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker requires PHP 5.4 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

What is Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker's security score?

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker has a WP-Safety security score of 76/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Security & Risk Analysis

wordpress.org/plugins/quiz-master-next

Quiz maker & survey maker for WordPress. Build quizzes, surveys, exams & assessments with scoring, results pages & lead capture — free & easy.

40K active installs v11.2.2 PHP 5.4+ WP 4.9+ Updated Jul 18, 2026

examquizquiz-makersurveysurvey-maker

B · Generally Safe

CVEs total66

Unpatched0

Last CVEJul 2, 2026

Plugin page Download

Safety Verdict

Is Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Safe to Use in 2026?

Mostly Safe

Score 76/100

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker is generally safe to use. 66 past CVEs were resolved.

66 known CVEsLast CVE: Jul 2, 2026Updated 1mo ago

Risk Assessment

The security posture of Quiz Master Next v10.3.5 presents a mixed bag, with some strong security practices offset by significant areas of concern. The plugin demonstrates good practices in its use of prepared statements for SQL queries and a high percentage of properly escaped outputs, indicating an effort to mitigate common web vulnerabilities. However, the presence of a dangerous `unserialize` function, coupled with a substantial number of unsanitized taint flows, particularly those of high severity, raises serious red flags regarding potential deserialization and code execution vulnerabilities. The large number of unprotected AJAX handlers and REST API routes further expands the attack surface, making these entry points prime targets for exploitation if authorization checks are insufficient.

The plugin's vulnerability history is a major concern, with a staggering 57 known CVEs. While there are currently no unpatched vulnerabilities, the sheer volume and the prevalence of critical and high-severity past issues, including deserialization, XSS, CSRF, and SQL injection, strongly suggest recurring security weaknesses in the development lifecycle. This pattern indicates a persistent struggle with robust input validation and secure coding practices across various vulnerability types. The last reported vulnerability in 2026 also suggests a potential for newly discovered issues or a lag in security patching if the codebase remains stagnant.

In conclusion, while Quiz Master Next v10.3.5 shows some strengths in output sanitization and SQL query handling, the identified risks in its code analysis (unprotected entry points, dangerous functions, high-severity taint flows) and its extensive history of critical and high-severity vulnerabilities paint a picture of a plugin that requires significant attention to security. The potential for deserialization attacks and exploitation of its broad unprotected attack surface are the most pressing threats, compounded by the historical tendency for severe security flaws.

Key Concerns

Unprotected AJAX handlers
Unprotected REST API routes
Dangerous function: unserialize
High severity unsanitized taint flows
High number of critical/high past CVEs
Large attack surface

Vulnerabilities

66 published

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Security Vulnerabilities

CVEs by Year

1 CVE in 2015

2015

1 CVE in 2016

2016

2 CVEs in 2019

2019

4 CVEs in 2020

2020

6 CVEs in 2021

2021

16 CVEs in 2022

2022

10 CVEs in 2023

2023

7 CVEs in 2024

2024

5 CVEs in 2025

2025

14 CVEs in 2026

2026

Patched Has unpatched

Severity Breakdown

Critical

High

Medium

66 total CVEs

CVE-2026-9230medium · 4.3Missing Authorization

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure

Jul 2, 2026 Patched in 11.1.5 (1d)

CVE-2026-9233medium · 4.3Missing Authorization

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action

Jun 26, 2026 Patched in 11.1.5 (1d)

CVE-2026-6448medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters

Jun 5, 2026 Patched in 11.1.3 (1d)

CVE-2026-48867high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting

Jun 3, 2026 Patched in 11.1.3 (6d)

CVE-2026-40787high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting

Apr 23, 2026 Patched in 11.1.0 (8d)

CVE-2026-5797medium · 5.3Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields

Apr 16, 2026 Patched in 11.1.1 (1d)

CVE-2026-2412medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter

Mar 23, 2026 Patched in 11.0.0 (1d)

CVE-2026-25329medium · 4.3Missing Authorization

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization

Feb 5, 2026 Patched in 10.3.5 (89d)

CVE-2026-25324medium · 5.3Authorization Bypass Through User-Controlled Key

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference

Feb 1, 2026 Patched in 10.3.5 (93d)

CVE-2025-67987medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection

Jan 28, 2026 Patched in 10.3.2 (6d)

CVE-2026-24358medium · 4.3Missing Authorization

Quiz And Survey Master <= 10.3.3 - Missing Authorization

Jan 8, 2026 Patched in 10.3.4 (27d)

CVE-2025-9637medium · 6.5Missing Authorization

Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads

Jan 5, 2026 Patched in 10.3.2 (1d)

CVE-2025-9318medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter

Jan 5, 2026 Patched in 10.3.2 (1d)

CVE-2025-9294medium · 4.3Improper Authorization

Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion

Jan 5, 2026 Patched in 10.3.2 (60d)

CVE-2025-63054medium · 5.3Missing Authorization

Quiz And Survey Master <= 10.3.2 - Missing Authorization

Nov 30, 2025 Patched in 10.3.3 (38d)

CVE-2025-49401high · 8.1Deserialization of Untrusted Data

Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection

Sep 3, 2025 Patched in 10.2.6 (9d)

CVE-2025-55708medium · 6.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection

Aug 14, 2025 Patched in 10.2.5 (6d)

CVE-2025-6790medium · 4.3Cross-Site Request Forgery (CSRF)

Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation

Jul 24, 2025 Patched in 10.2.3 (33d)

CVE-2024-10679medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Mar 11, 2025 Patched in 9.2.1 (36d)

CVE-2024-8758medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) <= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Sep 2, 2024 Patched in 9.1.3 (33d)

CVE-2024-6879medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Aug 5, 2024 Patched in 9.1.1 (24d)

CVE-2024-6390medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jul 13, 2024 Patched in 9.1.0 (28d)

CVE-2024-6025medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master <= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jun 20, 2024 Patched in 9.0.5 (9d)

CVE-2024-4934medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jun 10, 2024 Patched in 9.0.2 (23d)

CVE-2024-3592critical · 9.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection

Jun 6, 2024 Patched in 9.0.2 (28d)

CVE-2024-27966medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 8.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Mar 13, 2024 Patched in 8.2.3 (8d)

CVE-2023-51521medium · 4.3Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 8.1.18 - Cross-Site Request Forgery

Dec 27, 2023 Patched in 8.1.19 (27d)

CVE-2023-51507medium · 5.3Missing Authorization

Quiz And Survey Master <= 8.1.16 - Missing Authorization

Dec 27, 2023 Patched in 8.1.17 (27d)

CVE-2023-47834medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Nov 16, 2023 Patched in 8.1.14 (68d)

WF-32173d38-7f85-4e0c-9b4c-38bee2783d77-quiz-master-nextmedium · 4.3Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 8.1.15 - Cross-Site Request Forgery via 'display_results'

Sep 12, 2023 Patched in 8.1.16 (133d)

CVE-2023-3575medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 8.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title

Jul 17, 2023 Patched in 8.1.11 (190d)

CVE-2023-37984medium · 5.3Improper Control of Interaction Frequency

Quiz And Survey Master <= 8.1.10 - Excessive Quiz Attempts

Jul 17, 2023 Patched in 8.1.11 (190d)

CVE-2023-28787critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz and Survey Master <= 8.1.4 - Unauthenticated SQL Injection

Apr 16, 2023 Patched in 8.1.5 (282d)

CVE-2023-26524medium · 4.3Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 8.0.10 - Cross-Site Request Forgery to Quiz Restoration

Feb 28, 2023 Patched in 8.1.0 (329d)

CVE-2023-0291high · 7.2Missing Authorization

Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion

Feb 15, 2023 Patched in 8.0.9 (342d)

CVE-2023-0292medium · 5.4Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion

Feb 8, 2023 Patched in 8.0.9 (349d)

CVE-2022-46862medium · 4.3Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 8.0.7 - Cross-Site Request Forgery

Dec 16, 2022 Patched in 8.0.8 (403d)

CVE-2022-4032high · 7.2Improper Input Validation

Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer

Nov 29, 2022 Patched in 8.0.5 (420d)

CVE-2022-4033medium · 5.3Improper Input Validation

Quiz and Survey Master <= 8.0.4 - Improper Input Validation

Nov 16, 2022 Patched in 8.0.5 (433d)

WF-c829894f-05b8-4c65-9f3a-3a5d6e212cde-quiz-master-nexthigh · 8.8Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 7.3.10 - Cross-Site Request Forgery

Oct 23, 2022 Patched in 7.3.11 (457d)

CVE-2021-36898high · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection

Oct 21, 2022 Patched in 7.3.5 (459d)

CVE-2021-36906medium · 5.4Authorization Bypass Through User-Controlled Key

Quiz And Survey Master <= 7.3.6 - Insecure Direct Object Reference

Oct 21, 2022 Patched in 7.3.7 (459d)

CVE-2022-40698high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting

Oct 21, 2022 Patched in 7.3.11 (459d)

CVE-2021-36864medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.4 - Reflected Cross-Site Scripting

Oct 21, 2022 Patched in 7.3.5 (459d)

CVE-2022-41652medium · 4.3Missing Authorization

Quiz And Survey Master <= 7.3.10 - Missing Authorization

Oct 21, 2022 Patched in 7.3.11 (459d)

CVE-2021-36905medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.4 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 21, 2022 Patched in 7.3.5 (459d)

CVE-2021-36863medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 21, 2022 Patched in 7.3.5 (459d)

CVE-2022-42883medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

Quiz And Survey Master <= 7.3.10 - Sensitive Information Disclosure

Oct 21, 2022 Patched in 7.3.11 (459d)

CVE-2021-36865medium · 5.4Authorization Bypass Through User-Controlled Key

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 7.3.4 - Insecure Direct Object Reference

Sep 29, 2022 Patched in 7.3.5 (481d)

CVE-2022-0182medium · 5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.6 - Stored Cross-Site Scripting

Jan 12, 2022 Patched in 7.3.7 (741d)

CVE-2022-0180high · 8.8Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 7.3.6 - Cross-Site Request Forgery

Jan 12, 2022 Patched in 7.3.7 (741d)

CVE-2022-0181medium · 5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.6 - Reflected Cross-Site Scripting

Jan 12, 2022 Patched in 7.3.7 (741d)

CVE-2021-24691medium · 4.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.3.1 - Admin+ Stored Cross-Site Scripting

Sep 13, 2021 Patched in 7.3.2 (862d)

CVE-2021-20792medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master <= 7.1.13 - Cross-Site Scripting

Sep 13, 2021 Patched in 7.1.14 (862d)

WF-9c2883e6-2a90-46c7-ba42-cc078e4d1670-quiz-master-nextmedium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master <= 7.1.13 - SQL Injection

Aug 10, 2021 Patched in 7.1.14 (896d)

WF-4b468c0b-88ac-4ea8-97a9-08e206faf0fb-quiz-master-nextmedium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.1.18 - Cross-Site Scripting

Jun 3, 2021 Patched in 7.1.19 (964d)

CVE-2021-24368medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 7.1.17 - Reflected Cross-Site Scripting

Jun 3, 2021 Patched in 7.1.18 (964d)

CVE-2021-24221high · 8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master <= 7.1.11 - Authenticated SQL injection via shortcode

Mar 26, 2021 Patched in 7.1.12 (1033d)

WF-26140315-04c7-4056-a570-865cd4ffe85e-quiz-master-nextcritical · 9.8Unrestricted Upload of File with Dangerous Type

Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload

Aug 29, 2020 Patched in 7.0.2 (1242d)

CVE-2020-35951high · 8.2Authorization Bypass Through User-Controlled Key

Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion

Aug 3, 2020 Patched in 7.0.1 (1268d)

CVE-2020-35949critical · 9.8Unrestricted Upload of File with Dangerous Type

Quiz and Survey Master <= 7.0.0 - Arbitrary File Upload

Aug 3, 2020 Patched in 7.0.1 (1268d)

WF-3f378797-a7a7-4691-8d37-1caef454bb4f-quiz-master-nextmedium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz and Survey Master <= 6.4.12 - Stored Cross-Site Scripting

Jul 29, 2020 Patched in 7.0.0 (1273d)

CVE-2019-17599medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 6.3.4 - Reflected Cross-Site Scripting

Nov 13, 2019 Patched in 6.3.5 (1532d)

CVE-2019-9575medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Quiz And Survey Master <= 6.2.1 - Cross-Site Scripting

Mar 5, 2019 Patched in 6.2.2 (1785d)

CVE-2016-11085high · 8.8Cross-Site Request Forgery (CSRF)

Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Dec 15, 2016 Patched in 4.7.9 (2595d)

WF-3a17b6ad-c778-4677-b5bd-6ffc9b425ba1-quiz-master-nexthigh · 8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Quiz And Survey Master < 4.4.4 - Multiple SQL Injections

Jul 16, 2015 Patched in 4.4.4 (3113d)

Version History

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Release Timeline

v11.2.2Current

v11.2.1

v11.2.0

v11.1.5

v11.1.42 CVEs

CVE-2026-9233 CVE-2026-9230

v11.1.32 CVEs

CVE-2026-9233 CVE-2026-9230

v11.1.24 CVEs

CVE-2026-48867 CVE-2026-6448 CVE-2026-9233 +1 more

v11.1.14 CVEs

CVE-2026-48867 CVE-2026-6448 CVE-2026-9233 +1 more

v11.1.05 CVEs

CVE-2026-5797 CVE-2026-48867 CVE-2026-6448 +2 more

v11.0.06 CVEs

CVE-2026-5797 CVE-2026-40787 CVE-2026-48867 +3 more

v10.3.57 CVEs

CVE-2026-2412 CVE-2026-5797 CVE-2026-40787 +4 more

v10.3.49 CVEs

CVE-2026-2412 CVE-2026-5797 CVE-2026-25329 +6 more

v10.3.310 CVEs

CVE-2026-24358 CVE-2026-2412 CVE-2026-5797 +7 more

v10.3.211 CVEs

CVE-2026-24358 CVE-2026-2412 CVE-2025-63054 +8 more

v10.3.115 CVEs

CVE-2026-24358 CVE-2025-67987 CVE-2025-9294 +12 more

v10.3.015 CVEs

CVE-2026-24358 CVE-2025-67987 CVE-2025-9294 +12 more

v10.2.815 CVEs

CVE-2026-24358 CVE-2025-67987 CVE-2025-9294 +12 more

v10.2.715 CVEs

CVE-2026-24358 CVE-2025-67987 CVE-2025-9294 +12 more

v10.2.615 CVEs

CVE-2026-24358 CVE-2025-67987 CVE-2025-9294 +12 more

v10.2.516 CVEs

CVE-2025-49401 CVE-2026-24358 CVE-2025-67987 +13 more

Code Analysis

Analyzed Mar 16, 2026

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Code Analysis

Dangerous Functions

Raw SQL Queries

119

351 prepared

Unescaped Output

161

2661 escaped

Nonce Checks

Capability Checks

File Operations

External Requests

Bundled Libraries

Dangerous Functions Found

unserialize$unserialized_value = unserialize( $value, array( 'allowed_classes' => false ) );php\template-variables.php:1652

Bundled Libraries

Select2

SQL Query Safety

75% prepared470 total queries

Output Escaping

94% escaped2822 total outputs

Data Flows · Security

29 unsanitized

Data Flow Analysis

25 flows29 with unsanitized paths

qsm_options_emails_tab_template (php\admin\options-page-email-tab.php:183)

Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized

Attack Surface

12 unprotected

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Attack Surface

Entry Points59

Unprotected12

AJAX Handlers 32

authwp_ajax_qsm_activate_pluginphp\admin\create-quiz-page.php:4

authwp_ajax_qsm_activate_plugin_ajax_handlerphp\admin\create-quiz-page.php:49

authwp_ajax_qsm_get_activated_themesphp\admin\create-quiz-page.php:52

authwp_ajax_qsm_insert_quiz_templatephp\admin\functions.php:1547

authwp_ajax_qsm_remove_my_templatesphp\admin\functions.php:1631

authwp_ajax_qsm_save_contactphp\admin\options-page-contact-tab.php:173

authwp_ajax_qsm_show_disabled_contact_fieldsphp\admin\options-page-contact-tab.php:211

authwp_ajax_qsm_unlink_question_from_listphp\admin\options-page-questions-tab.php:959

authwp_ajax_qsm_save_pagesphp\admin\options-page-questions-tab.php:1045

authwp_ajax_qsm_load_all_quiz_questionsphp\admin\options-page-questions-tab.php:1111

authwp_ajax_qsm_send_data_sendyphp\admin\options-page-questions-tab.php:1140

authwp_ajax_qsm_dashboard_delete_resultphp\admin\options-page-questions-tab.php:1192

authwp_ajax_qsm_delete_question_question_bankphp\admin\options-page-questions-tab.php:1273

authwp_ajax_qsm_delete_question_from_databasephp\admin\options-page-questions-tab.php:1327

authwp_ajax_qsm_bulk_delete_question_from_databasephp\admin\options-page-questions-tab.php:1408

authwp_ajax_save_new_categoryphp\admin\options-page-questions-tab.php:1486

authwp_ajax_qsm_get_question_text_messagephp\admin\options-page-text-tab.php:255

authwp_ajax_qsm_update_text_messagephp\admin\options-page-text-tab.php:292

authwp_ajax_qmn_question_type_changephp\classes\class-qmn-plugin-helper.php:82

authwp_ajax_qsm_validate_result_submissionphp\classes\class-qmn-plugin-helper.php:90

noprivwp_ajax_qsm_validate_result_submissionphp\classes\class-qmn-plugin-helper.php:91

authwp_ajax_qmn_process_quizphp\classes\class-qmn-quiz-manager.php:75

noprivwp_ajax_qmn_process_quizphp\classes\class-qmn-quiz-manager.php:76

noprivwp_ajax_qsm_create_quiz_noncephp\classes\class-qmn-quiz-manager.php:77

authwp_ajax_qsm_create_quiz_noncephp\classes\class-qmn-quiz-manager.php:78

authwp_ajax_qsm_export_dataphp\classes\class-qmn-quiz-manager.php:81

authwp_ajax_qsm_clear_audit_dataphp\classes\class-qmn-quiz-manager.php:84

noprivwp_ajax_qsm_ajax_loginphp\classes\class-qmn-quiz-manager.php:87

authwp_ajax_qsm_action_failed_submission_tablephp\classes\class-qmn-quiz-manager.php:90

authwp_ajax_qsm_check_fix_dbphp\classes\class-qmn-quiz-manager.php:93

authwp_ajax_enable_multiple_categoriesphp\classes\class-qsm-migrate.php:16

authwp_ajax_regenerate_api_keyphp\classes\class-qsm-quiz-api.php:17

REST API Routes 22

GET/wp-json/quiz-survey-master/v1/quiz/hierarchical-category-listblocks\block.php:300

GET/wp-json/quiz-survey-master/v1/quiz/advance-ques-type-upgrade-popupblocks\block.php:313

GET/wp-json/quiz-survey-master/v1/quiz/structureblocks\block.php:326

GET/wp-json/quiz-survey-master/v1/quiz/create_quizblocks\block.php:339

GET/wp-json/quiz-survey-master/v1/quiz/save_quizblocks\block.php:352

GET/wp-json/qsm/quiz(?:/(?P<quiz_id>\d+))?php\classes\class-qsm-quiz-api.php:22

GET/wp-json/qsm/quiz_result(?:/(?P<result_id>\d+))?php\classes\class-qsm-quiz-api.php:33

POST/wp-json/qsm/submitquiz/php\classes\class-qsm-quiz-api.php:44

GET/wp-json/qsm/get_questions/php\classes\class-qsm-quiz-api.php:55

GET/wp-json/quiz-survey-master/v1/questions/php\rest-api.php:17

GET/wp-json/quiz-survey-master/v1/questions/php\rest-api.php:28

GET/wp-json/quiz-survey-master/v1/questions/(?P<id>\d+)php\rest-api.php:39

GET/wp-json/quiz-survey-master/v1/questions/(?P<id>\d+)php\rest-api.php:50

GET/wp-json/quiz-survey-master/v1/quizzes/(?P<id>\d+)/resultsphp\rest-api.php:61

GET/wp-json/quiz-survey-master/v1/quizzes/(?P<id>\d+)/resultsphp\rest-api.php:72

GET/wp-json/quiz-survey-master/v1/quizzes/(?P<id>\d+)/emailsphp\rest-api.php:83

GET/wp-json/quiz-survey-master/v1/quizzes/(?P<id>\d+)/emailsphp\rest-api.php:94

GET/wp-json/qsm/list_quizphp\rest-api.php:106

GET/wp-json/qsm/list_results/(?P<id>\d+)php\rest-api.php:119

GET/wp-json/quiz-survey-master/v1/bank_questions/(?P<id>\d+)php\rest-api.php:131

GET/wp-json/quiz-survey-master/v1/quizzes/(?P<id>\d+)/categoriesphp\rest-api.php:143

GET/wp-json/quiz-survey-master/v2/quizzlist/php\rest-api.php:155

Shortcodes 5

[mlw_quizmaster] php\classes\class-qmn-quiz-manager.php:72

[qsm] php\classes\class-qmn-quiz-manager.php:73

[qsm_result] php\classes\class-qmn-quiz-manager.php:74

[qsm_link] php\shortcodes.php:54

[qsm_recent_quizzes] php\shortcodes.php:111

WordPress Hooks 162

actioninitblocks\block.php:33

actionenqueue_block_editor_assetsblocks\block.php:35

actionrest_api_initblocks\block.php:37

actionadmin_menumlw_quizmaster2.php:349

actionadmin_menumlw_quizmaster2.php:350

actionadmin_headmlw_quizmaster2.php:351

actioninitmlw_quizmaster2.php:352

actionadmin_initmlw_quizmaster2.php:354

filterparent_filemlw_quizmaster2.php:356

actionplugins_loadedmlw_quizmaster2.php:357

actionadmin_enqueue_scriptsmlw_quizmaster2.php:358

actionadmin_initmlw_quizmaster2.php:359

actionadmin_noticesmlw_quizmaster2.php:360

filtermanage_edit-qsm_category_columnsmlw_quizmaster2.php:361

actionadmin_footermlw_quizmaster2.php:1192

actionadmin_bar_menumlw_quizmaster2.php:1300

filterscript_loader_tagmlw_quizmaster2.php:1314

actioninitphp\admin\addons-page.php:203

actionadmin_enqueue_scriptsphp\admin\addons-page.php:418

actionupgrader_process_completephp\admin\admin-dashboard.php:450

actionadmin_initphp\admin\admin-dashboard.php:564

actionplugins_loadedphp\admin\admin-results-details-page.php:347

actioninitphp\admin\admin-results-page.php:84

actionwp_dashboard_setupphp\admin\dashboard-widgets.php:22

actionqmn_quiz_createdphp\admin\functions.php:22

actionadmin_initphp\admin\functions.php:50

actionadmin_initphp\admin\functions.php:259

actionadmin_initphp\admin\functions.php:818

actionadmin_initphp\admin\functions.php:875

actionadmin_page_access_deniedphp\admin\functions.php:889

actionqsm_global_settings_page_add_tab_afterphp\admin\functions.php:1843

actionqsm_global_settings_page_added_tab_contentphp\admin\functions.php:1936

actioninitphp\admin\options-page-contact-tab.php:18

actionadmin_footerphp\admin\options-page-contact-tab.php:170

actioninitphp\admin\options-page-email-tab.php:22

actionadmin_footerphp\admin\options-page-email-tab.php:80

actioninitphp\admin\options-page-option-tab.php:16

actioninitphp\admin\options-page-questions-tab.php:23

actionadmin_footerphp\admin\options-page-questions-tab.php:786

actioninitphp\admin\options-page-results-page-tab.php:21

actionadmin_footerphp\admin\options-page-results-page-tab.php:72

actioninitphp\admin\options-page-style-tab.php:26

actionadmin_menuphp\admin\options-page-style-tab.php:341

actioninitphp\admin\options-page-text-tab.php:17

actionadmin_footerphp\admin\quiz-options-page.php:290

actionadmin_noticesphp\admin\quizzes-page.php:39

actionload-edit.phpphp\admin\quizzes-page.php:40

filterget_edit_post_linkphp\admin\quizzes-page.php:41

filterviews_edit-qsm_quizphp\admin\quizzes-page.php:42

filtermanage_qsm_quiz_posts_columnsphp\admin\quizzes-page.php:43

actionmanage_qsm_quiz_posts_custom_columnphp\admin\quizzes-page.php:44

filterpost_row_actionsphp\admin\quizzes-page.php:45

filterbulk_actions-edit-qsm_quizphp\admin\quizzes-page.php:46

filterhandle_bulk_actions-edit-qsm_quizphp\admin\quizzes-page.php:47

actionmanage_posts_extra_tablenavphp\admin\quizzes-page.php:48

actionadmin_footerphp\admin\quizzes-page.php:49

actionadmin_initphp\admin\settings-page.php:37

actionadmin_initphp\admin\settings-page.php:38

filterpre_update_option_qmn-settingsphp\admin\settings-page.php:39

actionadmin_enqueue_scriptsphp\admin\settings-page.php:48

actioninitphp\admin\stats-page.php:63

actioninitphp\classes\class-qmn-log-manager.php:19

actioninitphp\classes\class-qmn-log-manager.php:21

actionadmin_initphp\classes\class-qmn-plugin-helper.php:83

actionqsm_saved_questionphp\classes\class-qmn-plugin-helper.php:84

actionqsm_saved_text_messagephp\classes\class-qmn-plugin-helper.php:85

actionqsm_saved_quiz_settingsphp\classes\class-qmn-plugin-helper.php:86

actionqsm_register_language_supportphp\classes\class-qmn-plugin-helper.php:88

filterqsm_language_supportphp\classes\class-qmn-plugin-helper.php:89

filterqsm_load_questions_by_pagesphp\classes\class-qmn-plugin-helper.php:1204

actioninitphp\classes\class-qmn-quiz-manager.php:86

filterwp_mail_content_typephp\classes\class-qmn-quiz-manager.php:2790

filterwp_mail_content_typephp\classes\class-qmn-quiz-manager.php:2896

filterqmn_begin_shortcodephp\classes\class-qmn-quiz-manager.php:3095

filterqmn_begin_shortcodephp\classes\class-qmn-quiz-manager.php:3128

filterqmn_begin_shortcodephp\classes\class-qmn-quiz-manager.php:3180

filterqmn_begin_quizphp\classes\class-qmn-quiz-manager.php:3220

filterqmn_begin_quizphp\classes\class-qmn-quiz-manager.php:3237

filterqmn_begin_quiz_formphp\classes\class-qmn-quiz-manager.php:3270

filterqmn_begin_quizphp\classes\class-qmn-quiz-manager.php:3282

filterqmn_begin_resultsphp\classes\class-qmn-quiz-manager.php:3302

filterwp_video_extensionsphp\classes\class-qmn-quiz-manager.php:3331

actionadmin_initphp\classes\class-qmn-review-message.php:34

actionadmin_noticesphp\classes\class-qmn-review-message.php:48

filterwp_mail_content_typephp\classes\class-qsm-emails.php:36

actionadmin_initphp\classes\class-qsm-install.php:30

filterplugin_row_metaphp\classes\class-qsm-install.php:32

actioninitphp\classes\class-qsm-install.php:33

actionrest_api_initphp\classes\class-qsm-quiz-api.php:16

actionadmin_noticesphp\classes\class-qsm-tracking.php:42

actionadmin_initphp\classes\class-qsm-tracking.php:43

actioninitphp\classes\class-qsm-tracking.php:44

actionplugins_loadedphp\default-templates.php:10

actionadmin_initphp\gdpr.php:14

filterwp_privacy_personal_data_exportersphp\gdpr.php:15

filterwp_privacy_personal_data_erasersphp\gdpr.php:16

actioninitphp\question-types.php:29

actioninitphp\question-types.php:30

actioninitphp\question-types.php:31

actioninitphp\question-types.php:32

actioninitphp\question-types.php:33

actioninitphp\question-types.php:34

actioninitphp\question-types.php:35

actioninitphp\question-types.php:36

actioninitphp\question-types.php:37

actioninitphp\question-types.php:38

actioninitphp\question-types.php:39

actioninitphp\question-types.php:40

actioninitphp\question-types.php:41

actioninitphp\question-types.php:42

actioninitphp\question-types.php:43

actioninitphp\question-types.php:282

actionrest_api_initphp\rest-api.php:9

actionwp_enqueue_scriptsphp\shortcodes.php:120

actionwp_headphp\shortcodes.php:207

filterqmn_end_shortcodephp\shortcodes.php:243

filterqmn_end_shortcodephp\shortcodes.php:260

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:19

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:20

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:21

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:22

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:23

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:24

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:25

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:26

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:27

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:28

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:29

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:30

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:31

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:32

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:33

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:34

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:35

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:36

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:37

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:38

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:39

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:40

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:41

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:42

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:43

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:44

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:45

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:46

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:47

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:48

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:49

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:50

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:51

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:52

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:53

filterqmn_end_resultsphp\template-variables.php:54

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:55

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:56

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:57

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:58

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:59

filtermlw_qmn_template_variable_quiz_pagephp\template-variables.php:60

filtermlw_qmn_template_variable_results_pagephp\template-variables.php:61

filterqmn_end_resultsphp\template-variables.php:944

filterwp_kses_allowed_htmlphp\template-variables.php:1018

Maintenance & Trust

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2

Last updatedJul 18, 2026

PHP min version5.4

Downloads3.3M

Community Trust

Rating94/100

Number of ratings1,279

Active installs40K

Alternatives

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Alternatives

involve.me – Create Surveys, Quizzes, Calculators & Forms as Embedded Widgets or Pop-ups

involve-me

Add forms, quizzes, surveys and interactive calculators to your WordPress site. Easily embed or use as pop-ups. No coding required.

400 No CVEs

Riddle Quiz Maker – easily add quizzes with unlimited lead generation to your site

riddle-playful-content-on-the-go

100

Riddle’s beautifully intuitive quiz maker lets you create unlimited quizzes, personality tests, and more—no coding, no limits.

300 No CVEs

Quiz Maker by AYS

quiz-maker

QUIZ MAKER plugin allows you to make an unlimited number of Quizzes, Exams and Tests

20K 24 CVEs

HD Quiz

hd-quiz

Create a Quiz. An easy-to-use feature rich plugin to create quizzes with quiz timer, pagination, hints, advanced marking, and leading help and support

7K 5 CVEs

Quiz Maker, Poll Maker & Survey Maker by Opinion Stage

social-polls-by-opinionstage

Boost engagement and capture leads with interactive quizzes, polls, and surveys. Built for marketers, publishers, and businesses

6K 7 CVEs

Developer Profile

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Developer Profile

ExpressTech Systems

22 plugins · 112K total installs

trust score

Avg Security Score

90/100

Avg Patch Time

487 days

View full developer profile

Detection Fingerprints

How We Detect Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths

/wp-content/plugins/quiz-master-next/css/style.css/wp-content/plugins/quiz-master-next/js/quiz_master_next.js/wp-content/plugins/quiz-master-next/js/public/quiz-master-next-frontend.js/wp-content/plugins/quiz-master-next/js/admin/quiz-master-next-admin.js/wp-content/plugins/quiz-master-next/css/admin/quiz-master-next-admin.css

Script Paths

/wp-content/plugins/quiz-master-next/js/quiz_master_next.js/wp-content/plugins/quiz-master-next/js/public/quiz-master-next-frontend.js/wp-content/plugins/quiz-master-next/js/admin/quiz-master-next-admin.js

Version Parameters

quiz-master-next/style.css?ver=quiz-master-next/js/quiz_master_next.js?ver=quiz-master-next/js/public/quiz-master-next-frontend.js?ver=quiz-master-next/js/admin/quiz-master-next-admin.js?ver=quiz-master-next/css/admin/quiz-master-next-admin.css?ver=

HTML / DOM Fingerprints

CSS Classes

qsm_custom_css

HTML Comments

QSM Debug InfoSTART QSM Debug InfoEND QSM Debug Info

Data Attributes

data-quiz_iddata-quiz_namedata-quiz_result_type

JS Globals

qsm_ajax_objectquiz_master_next_global

REST Endpoints

/wp-json/quizmaster_next/v1/quiz_data/wp-json/quizmaster_next/v1/quiz_submit

Shortcode Output

[quiz_master_next]

FAQ

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Security & Risk Analysis

Is Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Safe to Use in 2026?

Mostly Safe

Key Concerns

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Security Vulnerabilities

CVEs by Year

Severity Breakdown

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Release Timeline

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Code Analysis

Dangerous Functions Found

Bundled Libraries

SQL Query Safety

Output Escaping

Data Flow Analysis

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Attack Surface

AJAX Handlers 32

REST API Routes 22

Shortcodes 5

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Maintenance & Trust

Maintenance Signals

Community Trust

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Alternatives

involve.me – Create Surveys, Quizzes, Calculators & Forms as Embedded Widgets or Pop-ups

Riddle Quiz Maker – easily add quizzes with unlimited lead generation to your site

Quiz Maker by AYS

HD Quiz

Quiz Maker, Poll Maker & Survey Maker by Opinion Stage

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker Developer Profile

How We Detect Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

Asset Fingerprints

HTML / DOM Fingerprints

Frequently Asked Questions about Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker