Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

82 Quality Score

Active Installs

21/30

At 40,000 active installs it sits in the mid-tier for quiz plugins, well behind the 500,000 installs of SureForms but ahead of Quiz Maker by AYS.

Update Freshness

25/25

A last update on 2026-06-29 and a maintenance score of 100/25 suggest the developer is actively shipping fixes and improvements on a frequent cadence.

User Rating

14/15

The 94/100 rating from 1,279 reviewers is a strong signal that real users are happy with the plugin's feature set and reliability.

Support Health

8/15

With only 4 support threads on record and a 75% resolution rate, support volume is low enough that the metric is hard to interpret, but resolution performance is solid.

WP Compatibility

15/15

Full marks for compatibility, with a minimum PHP 5.4 and WordPress 4.9 requirement that runs on virtually any host, and tested up to WordPress 7.0.

Scores higher than 88% of indexed plugins

About

Quiz maker & survey maker for WordPress. Build quizzes, surveys, exams & assessments with scoring, results pages & lead capture — free & easy.

Active Installs 40k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-24 1:45pm GMT

Requires WordPress 5.0+

Tested Up To 7.1.2

Requires PHP 5.4+

Security History

77 known vulnerabilities, all patched

4 Critical 13 High 60 Medium

Most recent: September 10, 2026

View details ▸

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.5 - Unauthenticated Insecure Direct Object Reference Medium

September 10, 2026 Patched in ["11.2.6"] CVE-2026-62140

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.4 - Authenticated (Contributor+) Insecure Direct Object Reference Medium

August 28, 2026 Patched in ["11.2.4"] CVE-2026-79615

Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference Medium

August 17, 2026 Patched in ["11.2.4"] CVE-2026-14826

Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference Medium

August 17, 2026 Patched in ["11.2.4"] CVE-2026-14825

Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option Medium

August 15, 2026 Patched in ["11.2.2"] CVE-2026-15963

Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter Medium

August 15, 2026 Patched in ["11.2.2"] CVE-2026-11780

Quiz And Survey Master <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

July 27, 2026 Patched in ["11.2.2"] CVE-2026-14824

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection Medium

July 22, 2026 Patched in ["11.2.1"] CVE-2026-65454

Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter Medium

July 15, 2026 Patched in ["11.2.1"] CVE-2026-13767

Quiz And Survey Master <= 11.1.4 - Missing Authorization Medium

July 7, 2026 Patched in ["11.1.5"] CVE-2026-14821

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.1.3 - Unauthenticated User Enumeration Medium

July 6, 2026 Patched in ["11.1.3"] CVE-2026-14820

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure Medium

July 2, 2026 Patched in ["11.1.5"] CVE-2026-9230

Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action Medium

June 26, 2026 Patched in ["11.1.5"] CVE-2026-9233

Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters Medium

June 5, 2026 Patched in ["11.1.3"] CVE-2026-6448

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting High

June 3, 2026 Patched in ["11.1.3"] CVE-2026-48867

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting High

April 23, 2026 Patched in ["11.1.0"] CVE-2026-40787

Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields Medium

April 16, 2026 Patched in ["11.1.1"] CVE-2026-5797

Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter Medium

March 23, 2026 Patched in ["11.0.0"] CVE-2026-2412

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization Medium

February 5, 2026 Patched in ["10.3.5"] CVE-2026-25329

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference Medium

February 1, 2026 Patched in ["10.3.5"] CVE-2026-25324

Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection Medium

January 28, 2026 Patched in ["10.3.2"] CVE-2025-67987

Quiz And Survey Master <= 10.3.3 - Missing Authorization Medium

January 8, 2026 Patched in ["10.3.4"] CVE-2026-24358

Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads Medium

January 5, 2026 Patched in ["10.3.2"] CVE-2025-9637

Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter Medium

January 5, 2026 Patched in ["10.3.2"] CVE-2025-9318

Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion Medium

January 5, 2026 Patched in ["10.3.2"] CVE-2025-9294

Quiz And Survey Master <= 10.3.2 - Missing Authorization Medium

November 30, 2025 Patched in ["10.3.3"] CVE-2025-63054

Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection High

September 3, 2025 Patched in ["10.2.6"] CVE-2025-49401

Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection Medium

August 14, 2025 Patched in ["10.2.5"] CVE-2025-55708

Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation Medium

July 24, 2025 Patched in ["10.2.3"] CVE-2025-6790

Quiz and Survey Master (QSM) <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

March 11, 2025 Patched in ["9.2.1"] CVE-2024-10679

Quiz and Survey Master (QSM) <= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

September 2, 2024 Patched in ["9.1.3"] CVE-2024-8758

Quiz and Survey Master (QSM) <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

August 5, 2024 Patched in ["9.1.1"] CVE-2024-6879

Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

July 13, 2024 Patched in ["9.1.0"] CVE-2024-6390

Quiz and Survey Master <= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 20, 2024 Patched in ["9.0.5"] CVE-2024-6025

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 10, 2024 Patched in ["9.0.2"] CVE-2024-4934

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection Critical

June 6, 2024 Patched in ["9.0.2"] CVE-2024-3592

Quiz And Survey Master <= 8.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 13, 2024 Patched in ["8.2.3"] CVE-2024-27966

Quiz And Survey Master <= 8.1.18 - Cross-Site Request Forgery Medium

December 27, 2023 Patched in ["8.1.19"] CVE-2023-51521

Quiz And Survey Master <= 8.1.16 - Missing Authorization Medium

December 27, 2023 Patched in ["8.1.17"] CVE-2023-51507

Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

November 16, 2023 Patched in ["8.1.14"] CVE-2023-47834

Quiz And Survey Master <= 8.1.15 - Cross-Site Request Forgery via 'display_results' Medium

September 12, 2023 Patched in ["8.1.16"]

Quiz And Survey Master <= 8.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title Medium

July 17, 2023 Patched in ["8.1.11"] CVE-2023-3575

Quiz And Survey Master <= 8.1.10 - Excessive Quiz Attempts Medium

July 17, 2023 Patched in ["8.1.11"] CVE-2023-37984

Quiz and Survey Master <= 8.1.4 - Unauthenticated SQL Injection Critical

April 16, 2023 Patched in ["8.1.5"] CVE-2023-28787

Quiz And Survey Master <= 8.0.10 - Cross-Site Request Forgery to Quiz Restoration Medium

February 28, 2023 Patched in ["8.1.0"] CVE-2023-26524

Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion High

February 15, 2023 Patched in ["8.0.9"] CVE-2023-0291

Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion Medium

February 8, 2023 Patched in ["8.0.9"] CVE-2023-0292

Quiz And Survey Master <= 8.0.7 - Cross-Site Request Forgery Medium

December 16, 2022 Patched in ["8.0.8"] CVE-2022-46862

Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer High

November 29, 2022 Patched in ["8.0.5"] CVE-2022-4032

Quiz and Survey Master <= 8.0.4 - Improper Input Validation Medium

November 16, 2022 Patched in ["8.0.5"] CVE-2022-4033

Quiz And Survey Master <= 7.3.10 - Cross-Site Request Forgery High

October 23, 2022 Patched in ["7.3.11"]

Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection High

October 21, 2022 Patched in ["7.3.5"] CVE-2021-36898

Quiz And Survey Master <= 7.3.6 - Insecure Direct Object Reference Medium

October 21, 2022 Patched in ["7.3.7"] CVE-2021-36906

Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting High

October 21, 2022 Patched in ["7.3.11"] CVE-2022-40698

Quiz And Survey Master <= 7.3.4 - Reflected Cross-Site Scripting Medium

October 21, 2022 Patched in ["7.3.5"] CVE-2021-36864

Quiz And Survey Master <= 7.3.10 - Missing Authorization Medium

October 21, 2022 Patched in ["7.3.11"] CVE-2022-41652

Quiz And Survey Master <= 7.3.4 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting Medium

October 21, 2022 Patched in ["7.3.5"] CVE-2021-36905

Quiz And Survey Master <= 7.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

October 21, 2022 Patched in ["7.3.5"] CVE-2021-36863

Quiz And Survey Master <= 7.3.10 - Sensitive Information Disclosure Medium

October 21, 2022 Patched in ["7.3.11"] CVE-2022-42883

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 7.3.4 - Insecure Direct Object Reference Medium

September 29, 2022 Patched in ["7.3.5"] CVE-2021-36865

Quiz And Survey Master <= 7.3.6 - Stored Cross-Site Scripting Medium

January 12, 2022 Patched in ["7.3.7"] CVE-2022-0182

Quiz And Survey Master <= 7.3.6 - Cross-Site Request Forgery High

January 12, 2022 Patched in ["7.3.7"] CVE-2022-0180

Quiz And Survey Master <= 7.3.6 - Reflected Cross-Site Scripting Medium

January 12, 2022 Patched in ["7.3.7"] CVE-2022-0181

Quiz And Survey Master <= 7.3.1 - Admin+ Stored Cross-Site Scripting Medium

September 13, 2021 Patched in ["7.3.2"] CVE-2021-24691

Quiz and Survey Master <= 7.1.13 - Cross-Site Scripting Medium

September 13, 2021 Patched in ["7.1.14"] CVE-2021-20792

Quiz and Survey Master <= 7.1.13 - SQL Injection Medium

August 10, 2021 Patched in ["7.1.14"]

Quiz And Survey Master <= 7.1.18 - Cross-Site Scripting Medium

June 3, 2021 Patched in ["7.1.19"]

Quiz And Survey Master <= 7.1.17 - Reflected Cross-Site Scripting Medium

June 3, 2021 Patched in ["7.1.18"] CVE-2021-24368

Quiz And Survey Master <= 7.1.11 - Authenticated SQL injection via shortcode High

March 26, 2021 Patched in ["7.1.12"] CVE-2021-24221

Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload Critical

August 29, 2020 Patched in ["7.0.2"]

Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion High

August 3, 2020 Patched in ["7.0.1"] CVE-2020-35951

Quiz and Survey Master <= 7.0.0 - Arbitrary File Upload Critical

August 3, 2020 Patched in ["7.0.1"] CVE-2020-35949

Quiz and Survey Master <= 6.4.12 - Stored Cross-Site Scripting Medium

July 29, 2020 Patched in ["7.0.0"]

Quiz And Survey Master <= 6.3.4 - Reflected Cross-Site Scripting Medium

November 13, 2019 Patched in ["6.3.5"] CVE-2019-17599

Quiz And Survey Master <= 6.2.1 - Cross-Site Scripting Medium

March 5, 2019 Patched in ["6.2.2"] CVE-2019-9575

Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting High

December 15, 2016 Patched in ["4.7.9"] CVE-2016-11085

Quiz And Survey Master < 4.4.4 - Multiple SQL Injections High

July 16, 2015 Patched in ["4.4.4"]

What It Does

Quiz and Survey Master lets you build quizzes, surveys, polls, and tests directly in the WordPress editor, with conditional logic, timed questions, scoring, and result emails built in. It ships with a results dashboard so you can export or analyse responses from your WP backend. Add-ons extend it into e-commerce, certificates, reports, and integrations with Mailchimp, Zapier, and similar services.

Who It's For

It fits educators, course creators, corporate trainers, and certification providers who need a self-hosted quiz engine without paying SaaS fees per respondent. It also works for small businesses running customer feedback surveys or lead quizzes where they want the data to stay on their own WordPress database.

Who Should Skip It

If you only need a simple contact form or a 3-question poll, this is overkill and a lighter form plugin like SureForms or Everest Forms will be faster to set up. Anyone who expects a true drag-and-drop, modern block-editor experience may find the admin UI dated compared to newer alternatives.

The Bottom Line

Quiz and Survey Master earns an 82.21/100 overall score and is a dependable, actively maintained choice for WordPress sites that treat quizzes as a core feature. Its main trade-off is a less modern admin interface and a smaller install base than general-purpose form plugins, so simple use cases are better served by SureForms or Everest Forms.

Pick SureForms when you want a modern, drag-and-drop form builder with quiz capability bundled into a general-purpose form plugin that already has 500,000 installs.

Quiz Maker by AYS 88/100

Choose Quiz Maker by AYS if you want a more out-of-the-box quiz UI with built-in payment and certificate add-ons and do not need QSM's deeper hook system.

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 84/100

Go with Everest Forms when quizzes are a secondary feature and you mainly want a versatile form builder with AI assistance and a polished front-end experience.

Interactive Content – H5P 83/100

Choose H5P if you need richer interactive content like branching videos, drag-and-drop activities, and presentations, not just quizzes and surveys.

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 81/100

Pick Form Maker by 10Web when you want a simple mobile-friendly form and survey tool backed by a large commercial team, even though it is less quiz-focused.