Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload

The Quiz and Survey Master plugin for WordPress is vulnerable to arbitrary file uploads due to missing filename sanitization in the qsm_upload_image_fd_question() function in versions up to, and including, 7.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server using a double extension attack method which may make remote code execution possible on sites with a configuration that parse the first extension of a file. This is due to an incomplete fix of CVE-2020-35949.