Quiz and Survey Master (QSM)

Quiz and Survey Master before 11.1.5 omits a capability check from its output-template deletion operation. Any authenticated Contributor can select and delete arbitrary QSM output templates, allowing a low-privilege account to disrupt or alter quiz and survey presentation. The WPScan CNA record does not disclose the endpoint, action, template identifier parameter or deletion function.

Quiz and Survey Master before 11.1.3 exposes a front-end credential-check flow without rate limiting or useful audit controls and returns distinguishable responses for valid and invalid users. An unauthenticated attacker can use those response differences to enumerate usernames and repeatedly test passwords, potentially taking over an account whose credentials are guessed. The CNA record does not disclose the route, action, parameter names or validation function.

Quiz and Survey Master (QSM) is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.