Quiz and Survey Master <= 8.1.4 - SQL Injection
CVE-2023-28787
Verified
Description
ExpressTech Quiz And Survey Master (versions up to 8.1.4) contains an SQL injection caused by improper neutralization of special elements used in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires user interaction.
Severity
Critical
CVSS Score
8.6
Exploit Probability
2%
Published Date
February 6, 2026
Template Author
shivam kamboj
CVE-2023-28787.yaml
8.6Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE ID:
cve-2023-28787
CWE ID:
cwe-89
References
https://patchstack.com/articles/critical-unauthenticated-sql-injection-in-quiz-and-survey-master/https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-8-1-4-unauthenticated-sql-injection-vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2023-28787
Remediation Steps
Update to the latest version of Quiz And Survey Master that addresses this vulnerability.