---
id: "CVE-2026-116509"
page: "https://infrastack.ai/live/CVE-2026-116509"
kind: "vulnerability"
aliases: ["CVE-2026-116509"]
title: "WordPress QSM quiz plugin: SQL injection via qpages parameter"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "quiz-master-next", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-11-13T10:17:25+00:00"
first_seen_at: "2026-11-13T10:47:10+00:00"
updated_at: "2026-11-13T10:55:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116509", "first_seen_at": "2026-11-13T10:47:10+00:00"}]
exploit_sources: []
---

# WordPress QSM quiz plugin: SQL injection via qpages parameter

Link for people: https://infrastack.ai/live/CVE-2026-116509 (this .md is for agents)

The Quiz and Survey Master (QSM) WordPress plugin up to and including 11.2.9 fails to escape the 'qpages' parameter before building a SQL query. An authenticated contributor-level user can append SQL to existing queries and extract sensitive data from the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed QSM plugin version in the WordPress admin under Plugins, or with `wp plugin get quiz-master-next --field=version` if WP-CLI is available.
- Look for any installed version at or below `11.2.9`.

## Timeline

- 2026-11-13T10:47:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116509

## From the sources

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_