Description
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Quiz and Survey Master (QSM) | < 9.0.2 | 9.0.2 |
References
- https://wpscan.com/vulnerability/e3eee6bc-1f69-4be1-b323-0c9b5fe7535e/ exploit vdb-entry technical-description