CVE-2023-0292

The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txtExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-nextPatch
• https://wordpress.org/plugins/quiz-master-next/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e6d27-7f6b-4bec-b653-c2024504f427?source=cveThird Party Advisory
• https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txtExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-nextPatch
• https://wordpress.org/plugins/quiz-master-next/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e6d27-7f6b-4bec-b653-c2024504f427?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0286There is a type confusion vulnerability relating to X.400 ad…7.4
• CVE-2023-0287A vulnerability was found in ityouknow favorites-web. It has…5.4
• CVE-2023-0288Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
• CVE-2023-0289Cross-site Scripting (XSS) - Stored in GitHub repository cra…5.4
• CVE-2023-0290Rapid7 Velociraptor did not properly sanitize the client ID …4.3
• CVE-2023-0291The Quiz And Survey Master for WordPress is vulnerable to au…9.1
• CVE-2023-0293The Mediamatic – Media Library Folders plugin for WordPress …4.3
• CVE-2023-0294The Mediamatic – Media Library Folders plugin for WordPress …4.3
• CVE-2023-0295The Launchpad plugin for WordPress is vulnerable to Stored C…4.8
• CVE-2023-0296The Birthday attack against 64-bit block ciphers flaw (CVE-2…5.3
• CVE-2023-0297Code Injection in GitHub repository pyload/pyload prior to 0…9.8
• CVE-2023-0298Incorrect Authorization in GitHub repository firefly-iii/fir…6.5