SQL Injection Vulnerability in Quiz And Survey Master by ExpressTech Systems
CVE-2025-67987

8.5HIGH

Key Information:

Vendor

WordPress
Status
Quiz And Survey Master
Vendor
CVE Published:
20 February 2026

What is CVE-2025-67987?

An SQL Injection vulnerability exists in the Quiz And Survey Master plugin by ExpressTech Systems, which allows attackers to execute arbitrary SQL commands through improperly sanitized input. This flaw affects versions of the plugin up to and including 10.3.1 and can lead to unauthorized data access or manipulation. Websites utilizing this plugin need to address this vulnerability to safeguard their data and maintain overall security.

Affected Version(s)

Quiz And Survey Master 0 <= 10.3.1

References

https://patchstack.com/database/Wordpress/Plugin/quiz-mas...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Doan Dinh Van | Patchstack Bug Bounty Program
.