A vulnerability in the Quiz and Survey Master plugin allows an authenticated user with Contributor or higher permissions to inject arbitrary SQL through the merged_question parameter. The lack of proper escaping or prepared statements permits inclusion of SQL metacharacters such as ), OR, AND, and #, leading to extraction of sensitive data stored in the database. This attack compromises the confidentiality of all data accessed through the plugin, potentially exposing user information or quiz results.

WordPress sites that have the Quiz and Survey Master plugin by expresstech installed with a version number of 10.3.5 or earlier are vulnerable. No information is provided about whether later releases contain a fix, but the documented affected range stops at 10.3.5.

The CVSS score of 6.5 indicates medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated as a Contributor or higher; no additional network or configuration prerequisites are described. Consequently, the threat remains medium, escalating if the site contains highly sensitive information.