ExpressTech vulnerabilities
We track 12 vulnerabilities in ExpressTech products across 6 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest ExpressTech vulnerabilities
- 8.8 High severity
Quiz And Survey Master: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- 7.2 High severity
Quiz and Survey Master (QSM) – Quiz Maker &…: Improper Neutralization of Input During Web Page Generation
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitizatio
- 8.8 High severity
Quiz And Survey Master: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- 7.1 High severity
Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
- 8.8 High severity
Quiz and Survey Master (QSM): Improper Neutralization of Special Elements used in an SQL Command
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
- 9.3 Critical severity
Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
- 8.8 High severity
Quiz And Survey Master – Best Quiz, Exam and…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
- 8.1 High severity
Quiz and Survey Master (QSM) – Easy Quiz and…: Cross-Site Request Forgery
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes
- 9.1 Critical severity
Quiz and Survey Master (QSM) – Easy Quiz and…: Missing Authorization
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for una
- 8.8 High severity
Quiz And Survey Master – Best Quiz, Exam and…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.
- 8.8 High severity
Responsive Menu (WordPress plugin): Unrestricted Upload of File with Dangerous Type
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
- 8.8 High severity
Quiz And Survey Master: Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.