# cve.now: Expresstech

The newest entries naming Expresstech as an affected vendor (up to 200), of 51 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103917](https://cve.now/CVE-2026-103917.md): Quiz and Survey Master (QSM) \<= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm\_unique\_key' Parameter (CVSS 6.5)
- [CVE-2026-111408](https://cve.now/CVE-2026-111408.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-107862](https://cve.now/CVE-2026-107862.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-96558](https://cve.now/CVE-2026-96558.md): Quiz and Survey Master (QSM) \<= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm\_hidden\_questions' Parameter (CVSS 7.2)
- [CVE-2026-104392](https://cve.now/CVE-2026-104392.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-104391](https://cve.now/CVE-2026-104391.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-97289](https://cve.now/CVE-2026-97289.md): WordPress Quiz And Survey Master plugin \<= 11.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15963](https://cve.now/CVE-2026-15963.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon\_category' Quiz Option (CVSS 6.5)
- [CVE-2026-11780](https://cve.now/CVE-2026-11780.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question\_title' Parameter (CVSS 6.4)
- [CVE-2026-13767](https://cve.now/CVE-2026-13767.md): Quiz and Survey Master (QSM) \<= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter (CVSS 6.5)
- [CVE-2026-9230](https://cve.now/CVE-2026-9230.md): Quiz and Survey Master (QSM) \<= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure (CVSS 4.3)
- [CVE-2026-9233](https://cve.now/CVE-2026-9233.md): Quiz and Survey Master (QSM) \<= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm\_insert\_quiz\_template AJAX Action (CVSS 4.3)
- [CVE-2026-48867](https://cve.now/CVE-2026-48867.md): WordPress Quiz And Survey Master plugin \<= 11.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-40787](https://cve.now/CVE-2026-40787.md): WordPress Quiz And Survey Master plugin \<= 11.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-6448](https://cve.now/CVE-2026-6448.md): Quiz and Survey Master (QSM) \<= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters (CVSS 4.9)
- [CVE-2026-5797](https://cve.now/CVE-2026-5797.md): Quiz and Survey Master (QSM) \<= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields (CVSS 5.3)
- [CVE-2026-2412](https://cve.now/CVE-2026-2412.md): Quiz and Survey Master (QSM) \<= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged\_question' Parameter (CVSS 6.5)
- [CVE-2025-9318](https://cve.now/CVE-2025-9318.md): Quiz and Survey Master (QSM) \<= 10.3.1 - Authenticated (Subscriber+) SQL Injection via \`is\_linking\` Query Parameter (CVSS 6.5)
- [CVE-2025-9637](https://cve.now/CVE-2025-9637.md): Quiz and Survey Master (QSM) \<= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads (CVSS 6.5)
- [CVE-2025-9294](https://cve.now/CVE-2025-9294.md): Quiz And Survey Master \<= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion (CVSS 4.3)
- [CVE-2023-37984](https://cve.now/CVE-2023-37984.md): WordPress Quiz And Survey Master plugin \<= 8.1.10 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-51507](https://cve.now/CVE-2023-51507.md): WordPress Quiz And Survey Master plugin \<= 8.1.16 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-3592](https://cve.now/CVE-2024-3592.md): Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress \<= 9.0.1 - Authenticated (Contributor+) SQL Injection (CVSS 9.9)
- [CVE-2023-28787](https://cve.now/CVE-2023-28787.md): WordPress Quiz And Survey Master plugin \<= 8.1.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-27966](https://cve.now/CVE-2024-27966.md): WordPress Quiz And Survey Master plugin \<= 8.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-51521](https://cve.now/CVE-2023-51521.md): WordPress Quiz And Survey Master plugin \<= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2023-47834](https://cve.now/CVE-2023-47834.md): WordPress Quiz And Survey Master Plugin \<= 8.1.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-26524](https://cve.now/CVE-2023-26524.md): WordPress Quiz And Survey Master Plugin \<= 8.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-0292](https://cve.now/CVE-2023-0292.md): Quiz And Survey Master \<= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion (CVSS 5.4)
- [CVE-2023-0291](https://cve.now/CVE-2023-0291.md): Quiz And Survey Master \<= 8.0.8 - Unauthenticated Arbitrary Media Deletion (CVSS 7.2)
- [CVE-2022-46862](https://cve.now/CVE-2022-46862.md): WordPress Quiz And Survey Master Plugin \<= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-4033](https://cve.now/CVE-2022-4033.md): Quiz and Survey Master \<= 8.0.4 - Improper Input Validation (CVSS 5.3)
- [CVE-2022-4032](https://cve.now/CVE-2022-4032.md): Quiz and Survey Master \<= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer (CVSS 7.2)
- [CVE-2022-42883](https://cve.now/CVE-2022-42883.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Sensitive Information Disclosure vulnerability (CVSS 5.3)
- [CVE-2022-40698](https://cve.now/CVE-2022-40698.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
- [CVE-2022-41652](https://cve.now/CVE-2022-41652.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Bypass vulnerability (CVSS 6.5)
- [CVE-2021-36905](https://cve.now/CVE-2021-36905.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 5.4)
- [CVE-2021-36906](https://cve.now/CVE-2021-36906.md): WordPress Quiz And Survey Master plugin \<= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities (CVSS 2.7)
- [CVE-2021-36898](https://cve.now/CVE-2021-36898.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability (CVSS 7.5)
- [CVE-2021-36864](https://cve.now/CVE-2021-36864.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 3.4)
- [CVE-2021-36863](https://cve.now/CVE-2021-36863.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
- [CVE-2021-36865](https://cve.now/CVE-2021-36865.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Insecure direct object references (IDOR) vulnerability (CVSS 3.8)
- [CVE-2022-25602](https://cve.now/CVE-2022-25602.md): WordPress Responsive Menu plugin \<= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability (CVSS 8.3)
- [CVE-2022-0182](https://cve.now/CVE-2022-0182.md): Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject (no CVSS)
- [CVE-2022-0181](https://cve.now/CVE-2022-0181.md): Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitra (no CVSS)
- [CVE-2022-0180](https://cve.now/CVE-2022-0180.md): Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the aut (no CVSS)
- [CVE-2021-20792](https://cve.now/CVE-2021-20792.md): Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script vi (no CVSS)
- [CVE-2021-24368](https://cve.now/CVE-2021-24368.md): Quiz And Survey Master \< 7.1.18 - Reflected Cross-Site Scripting (XSS) (no CVSS)
- [CVE-2021-24162](https://cve.now/CVE-2021-24162.md): Responsive Menu \< 4.0.4 - CSRF to Settings Update (no CVSS)
- [CVE-2021-24161](https://cve.now/CVE-2021-24161.md): Responsive Menu \< 4.0.4 - CSRF to Arbitrary File Upload (no CVSS)
- [CVE-2021-24160](https://cve.now/CVE-2021-24160.md): Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/expresstech
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.