Medium severity4.3NVD Advisory· Published Jan 6, 2026· Updated Apr 8, 2026

CVE-2025-9294

Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Expresstech/Quiz And Survey Master
cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*
Range: <10.3.2
Quiz and Survey Master/Quiz and Survey Master (QSM) – Easy Quiz and Survey Makerllm-fuzzy
Range: <=10.3.1
WordPress/Quiz and Survey Master (QSM)wp-canonicalize

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2nvdThird Party Advisory
plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/admin/options-page-questions-tab.phpnvdProduct
research.cleantalk.org/cve-2025-9294/nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000