ExpressTech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

• CVE-2026-103917 Medium 6.5 Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter –
• CVE-2026-96558 High 7.2 Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter 0.2%
• CVE-2026-15963 Medium 6.5 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option 0.5%
• CVE-2026-11780 Medium 6.4 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter 0.4%
• CVE-2026-13767 Medium 6.5 Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter 0.4%