CVE-2026-111408: WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
Published Oct 19, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Affected Software
1 affected component
ExpressTech Quiz And Survey Master<=11.2.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Quiz And Survey Master (quiz-master-next)to a version that resolves this vulnerability.Fixed in 11.2.8
Event History
Oct 19, 2026
CVE Published
via MITRE·09:09 AM
Data Sourced
via MITRE·09:09 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs network access and low-privileged access to the affected WordPress environment. No user interaction is required.
2
What is the potential impact?
Successful exploitation can allow high-impact compromise of confidentiality, integrity, and availability within the affected scope.
3
Which versions are affected?
Quiz And Survey Master versions through 11.2.7 are affected. The available data does not identify a fixed version.