Security Advisory

CVE-2026-14820

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-27 06:00:05

Last updated 2026-07-27 17:37:40

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.

← Browse all CVEs View on cve.org ↗