CVE-2026-116509 · Package
NO FIX YET
The Quiz and Survey Master (QSM) WordPress plugin up to and including 11.2.9 fails to escape the 'qpages' parameter before building a SQL query. An authenticated contributor-level user can append SQL to existing queries and extract sensitive data from the database.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the QSM WordPress plugin at version 11.2.9 or earlier where contributor-level or higher accounts exist. The injection runs through display_shortcode(), so sites that do not use the plugin's shortcode on published content are less exposed. Sites without contributor-or-higher users have a much smaller attack surface.
Not affected if no-contributor-accounts, plugin-not-installed
Who cares quiz-master-next, wordpress, wordpress-plugin
wp plugin get quiz-master-next --field=version if WP-CLI is available.11.2.9.No fix yet, per the sources.
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.