05/31/2026
If your business website runs on WordPress, hereâs a quick check for you đ
Thereâs a popular plugin called Quiz and Survey Master (QSM).
Itâs used by more than 40,000 websites to create quizzes, surveys and forms without needing any coding.
Unfortunately, versions 10.3.1 and older were recently found to have a serious security flaw.
The issue is whatâs known as an SQL injection vulnerability.
SQL is the language used to talk to a websiteâs database, the part that stores things like user accounts, submissions, and other important data.
An SQL injection flaw means someone can sneak malicious commands into that database.
In this case, any logged-in user, even someone with a basic subscriber account, could potentially inject commands into the system.
That could allow actions like:
đ« Accessing sensitive data
đ« Extracting information from the database
đ« Manipulating content
The vulnerability is tracked as CVE-2025-67987, and it was fixed in version 10.3.2.
The latest version available is 10.3.5, which is the safest bet.
Based on WordPress.org data, just over half of websites using QSM are on version 10.3. That means a large number are likely still vulnerable.
Thatâs potentially tens of thousands of sites.
Right now, thereâs no confirmed evidence of this flaw being actively exploited. But once a vulnerability is public, attackers often start scanning the internet looking for unpatched sites.
đ If your site uses this plugin, the solution is straightforward: Update it immediately đ
More broadly, this is a reminder of something I say often to business owners: WordPress itself isnât usually the weak link. Itâs the plugins.
Every plugin you install adds functionality but also adds potential risk.
If youâre not actively using a plugin or theme, it shouldnât just be deactivated. It should be deleted from the server completely.
Websites arenât a set and forget asset. Theyâre part of your digital infrastructure.
If theyâre vulnerable, they can become an entry point into your wider systems. Especially if admin accounts reuse passwords across services.
â When was the last time someone checked which plugins your website is running and whether theyâre fully up to date?