high8.8
CVE-2024-5606
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_ques…
Impact
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Expresstech | Quiz And Survey Master | before 9.0.2 |