CVE-2022-4033

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.

• CWE-20
• CWE-20

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5cc779-c7de-42e6-a812-5c0539067b8c?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4033Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4033Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4032The Quiz and Survey Master plugin for WordPress is vulnerabl…6.1
• CVE-2022-40320cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-b…8.8
• CVE-2022-40322SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 an…6.1
• CVE-2022-40323SysAid Help Desk before 22.1.65 allows XSS in the Password S…6.1
• CVE-2022-40324SysAid Help Desk before 22.1.65 allows XSS via the Linked SR…6.1
• CVE-2022-40325SysAid Help Desk before 22.1.65 allows XSS via the Asset Das…6.1
• CVE-2022-40337OASES (aka Open Aviation Strategic Engineering System) 8.8.0…8.8
• CVE-2022-4034The Appointment Hour Booking Plugin for WordPress is vulnera…7.8
• CVE-2022-40341mojoPortal v2.7 was discovered to contain an arbitrary file …8.8
• CVE-2022-40347SQL Injection vulnerability in Intern Record System version …9.8
• CVE-2022-40348Cross Site Scripting (XSS) vulnerability in Intern Record Sy…5.4
• CVE-2022-4035The Appointment Hour Booking plugin for WordPress is vulnera…6.1