The vulnerability in the Quiz and Survey Master plug‑in permits time‑based SQL injection through the is_linking query parameter. Because the input is not escaped and the existing SQL statement is not properly parameterized, an attacker with at least Subscriber level access can inject additional SQL code. This flaw enables the attacker to run arbitrary queries against the WordPress database, potentially leaking sensitive information. The weakness is a classic SQL injection, categorized as CWE‑89.

The affected product is the expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plug‑in for WordPress. All releases up to and including version 10.3.1 are vulnerable. Administrators should verify which version is installed on their sites and plan to update beyond 10.3.1.

The CVSS score of 6.5 indicates a moderate level of severity, but the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Subscriber or higher role and involves sending crafted HTTP requests to the plug‑in’s endpoint that processes the is_linking parameter. Because the attack vector is internal, the risk is limited to sites where an attacker can elevate to the required user level; however, once achieved, the data extraction capability is extensive.