CVE-2025-9318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9318", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-21T13:25:19.701Z", "datePublished": "2026-01-06T09:20:59.146Z", "dateUpdated": "2026-04-08T17:30:10.903Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:10.903Z"}, "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "10.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018is_linking\u2019 parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php#L533"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "timeline": [{"time": "2025-08-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-05T20:24:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:01:09.554483Z", "id": "CVE-2025-9318", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:01:14.390Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:01:09.554483Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:01:00.087Z"}}], "cna": {"title": "Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "10.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-05T20:24:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php#L533"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018is_linking\u2019 parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-06T09:20:59.146Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9318", "state": "PUBLISHED", "dateUpdated": "2026-01-06T14:01:14.390Z", "dateReserved": "2025-08-21T13:25:19.701Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T09:20:59.146Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "vendor": "expresstech", "versions": [{"lessThanOrEqual": "10.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7AECAB11-6DCA-4FCF-B614-133BB680CF29", "versionEndExcluding": "10.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018is_linking\u2019 parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'is_linking' en todas las versiones hasta la 10.3.1, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-9318", "lastModified": "2026-10-07T10:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9318", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:01:09.554483Z", "version": "2.0.3"}}]}, "published": "2026-01-06T10:15:48.780", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php#L533"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T18:52:06.038052+00:00", "value": {"mitigation_remediation": ["Upgrade the Quiz and Survey Master plug\u2011in to the latest available version (10.3.2 or newer) once released. ", "If an immediate upgrade is not possible, remove or restrict Subscriber and higher roles from accessing the plug\u2011in\u2019s API endpoints that accept the is_linking parameter by adjusting role capabilities or using a security plugin to block the endpoint. ", "Configure a web application firewall or similar sanitizing filter to validate the is_linking parameter, ensuring that only accepted values are allowed and to escape any injected SQL patterns."], "summary": {"action": "Patch", "impact": "Data exposure via authenticated SQL injection"}, "threat_synthesis": {"affected_systems": "The affected product is the expresstech Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plug\u2011in for WordPress. All releases up to and including version 10.3.1 are vulnerable. Administrators should verify which version is installed on their sites and plan to update beyond 10.3.1.", "description_and_impact": "The vulnerability in the Quiz and Survey Master plug\u2011in permits time\u2011based SQL injection through the is_linking query parameter. Because the input is not escaped and the existing SQL statement is not properly parameterized, an attacker with at least Subscriber level access can inject additional SQL code. This flaw enables the attacker to run arbitrary queries against the WordPress database, potentially leaking sensitive information. The weakness is a classic SQL injection, categorized as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate level of severity, but the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Subscriber or higher role and involves sending crafted HTTP requests to the plug\u2011in\u2019s endpoint that processes the is_linking parameter. Because the attack vector is internal, the risk is limited to sites where an attacker can elevate to the required user level; however, once achieved, the data extraction capability is extensive."}}}}, "created": "2026-01-06T14:15:48.333785+00:00", "updated": "2026-04-20T19:00:10.687358+00:00", "vendors": ["expresstech", "expresstech$PRODUCT$quiz_and_survey_master", "wordpress", "wordpress$PRODUCT$wordpress"]}