Live › vulnerability › CVE-2026-111408
Go to dashboardThe quiz-master-next WordPress plugin by ExpressTech deserializes untrusted data, which allows PHP object injection. Per the sources, an attacker could potentially reach code execution or take over the site, but the exact gadget chain is not described.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in the WordPress admin plugins list or wp-content/plugins/quiz-master-next; versions through 11.2.7 are affected.
Update Quiz And Survey Master (quiz-master-next) to a version later than 11.2.7; the patched version number is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-111408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.