The Quiz Master Next plugin for WordPress stores the user supplied *pages* parameter without proper escaping and later injects this value directly into an IN() clause of an SQL query. As a result, an authenticated user who can edit or own a quiz can inject a malicious payload that will be executed when any visitor, including administrators, opens the quiz’s Questions tab. The vulnerability is a second‑order injection and can be used to read or tamper with sensitive database contents. The weakness is a classic input validation error, identified as CWE‑89.

The flaw affects all installations of the Quiz and Survey Master – Quiz Maker & Survey Maker plugin from expresstech running version 11.2.0 or earlier on WordPress sites. Users with Author‑level access or higher who can edit a quiz are able to inject payloads. Any site using that plugin version is at risk, regardless of other WordPress settings.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score of less than 1% indicates a very low real‑world exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Attacks require valid authenticated credentials with at least Author role; the attack vector is second‑order, relying on the quiz’s Questions view to trigger execution. Because the payload is stored, any subsequent request that renders the quiz can result in data retrieval or modification.