Every recorded version, newest first, with what changed in each one.
Latest 11.3.015 versions
Undated · 15 versions
11.3.0
Latest
2 fixes1 security
Fixed
Fixed the Start button submitting the quiz in the new render.
Fixed the answer_array error in quick results in the legacy version.
Security
Fixed Contributor+ SQL injection via stored quiz page data (qpages).
11.2.9
1 new2 fixes2 security
New
Added an option to disable correct-answer highlighting for wrong responses.
Fixed
Text/HTML, Opt-in, and Captcha fields no longer affect score totals.
Improved score accuracy when Text/HTML sections are hidden by conditional logic, including the admin Results column.
Security
Fixed stored XSS in the question featured image field.
Fixed PHP Object Injection in quiz Contact tab settings.
11.2.8
1 fix3 security
Fixed
Fixed issue where the QSM block creates blank question copies when a quiz is embedded twice.
Security
Fixed stored XSS via question length settings and resolved a question-save IDOR vulnerability.
Blocked PHP Object Injection vulnerabilities via the quiz option element.
Prevented unauthenticated shortcode injection flaws via the result unique_id.
11.2.7
1 improvement3 fixes1 security
Improved
Improved icon display consistency when reloading pages.
Fixed
Respect the Draft/Published status when saving quiz questions.
Enforce the question limit when pagination is disabled.
Ensure quiz responses are saved correctly when the quiz page is cached.
Security
Improved input handling in the Audit Trail to prevent potential cross-site scripting issues.
11.2.6
1 security
Security
Improved validation of user inputs and query parameters to prevent unauthenticated enumeration of quiz results.
11.2.5
3 improvements3 fixes1 security
Improved
Prevented automatic scrolling to the quiz section when loading a homepage.
Set duplicated quizzes to Draft status instead of Published.
Improved the Default Questions popup UI in the admin panel.
Fixed
Fixed missing page timer settings for pages without a qpages entry.
Fixed JavaScript errors when the questions-per-page setting is 0.
Fixed PHP warnings that occurred when duplicating or submitting a quiz.
Security
Improved QSM login security by adding login attempt rate limiting to prevent repeated failed password attempts.
11.2.4
2 fixes4 security
Fixed
Fixed missing translations for question type names during Question Bank import.
Fixed quiz navigator jumping to incorrect pages and question numbers in the new renderer.
Security
Fixed a Contributor+ ownership bypass by validating author records instead of post meta.
Fixed a Contributor+ information disclosure issue in REST endpoints by enforcing per-quiz ownership checks
Restricted the Question Bank picker and CSV import to quizzes owned by the current user
Added direct file access protection and sanitized lazy-loaded answer IDs.
11.2.3
1 new2 improvements2 fixes1 change
New
Added default settings for newly created questions.
Improved
Added support for loading custom CSS on the results page.
Improved bulk import functionality with CSV question download handling.
Fixed
Resolved the processing message display configuration issue.
Fixed a cookie-related issue affecting embedded quizzes with randomized questions.
Changes
Patch: Improved API request validation for JavaScript alerts involving the question_title parameter.
11.2.2
4 security
Security
Fixed a Contributor+ stored XSS in the Polar question type where the "required" setting was emitted into an unquoted HTML attribute (CVE-2026-14824). Credit: Meher Sudhakar Abbireddi.
Fixed a Contributor+ cross-quiz IDOR write in the quiz text-message AJAX handler by enforcing a per-quiz ownership check (CVE-2026-14825). Credit: Revanth Hari Narayana Matte.
Fixed a Contributor+ cross-quiz information disclosure in the email and results REST GET endpoints by enforcing a per-quiz ownership check (CVE-2026-14826). Credit: Revanth Hari Narayana Matte.
Fixed a Contributor+ SQL injection via the "randon_category" quiz option by sanitizing category IDs before the query (CVE-2026-15963). Credit: PRISM.
11.2.1
1 new1 improvement1 fix1 change
New
Added an option to display the latest result in the Limited Entry Attempts feature.
Improved
Improved Answer Editor filters and Results Answer attributes.
Fixed
Fixed a JavaScript bug affecting the answer limit for Multiple Choice question types.
Changes
Patch: Improved API request validation for the question_title parameter.
11.2.0
1 new2 improvements1 fix1 change
New
Added the ability to configure page limits for individual pages when using manual pagination
Improved
Added support for translating quiz links generated with the "quiz_link" shortcode in WPML
Improved Media page UI compatibility with WordPress 7
Fixed
Resolved an issue where the progress bar was not displaying correctly for flashcard questions
Changes
Patch: Fixed a stored Cross-Site Scripting (XSS) vulnerability involving the "question_title" and "unique_id" parameters
11.1.5
2 new2 improvements
New
Added the %QSM_ADMIN_EMAIL% template variable to include the admin email in email templates
Added %QSM_START_QUIZ_DATE% and %QSM_END_QUIZ_DATE% template variables to display the quiz start and end dates
Improved
Improved validation and security measures when saving quiz email templates
Strengthened security checks for saving email and result templates
11.1.4
2 improvements1 fix1 change
Improved
Improved QSM Core UI compatibility with WordPress 7.0
Added category permission validation with enhanced UI error handling
Fixed
Fixed issues with bulk question imports and file reset functionality
Changes
Patch: Resolved an IDOR vulnerability in REST endpoints that could allow unauthorized quiz and question modifications
11.1.3
2 improvements1 fix1 change
Improved
Improved the question hints UI in the new quiz renderer
Strengthened security validation to get all the questions and user login functions
Fixed
Resolved result display issues with random questions and answers
Changes
Patch: Fixed a Cross-Site Scripting (XSS) vulnerability in rich answer type questions
11.1.2
1 new2 improvements2 fixes1 change
New
Added option to enable/disable public result sharing links
Improved
Improved date question type real time validation
Added support for correct answer info in bulk question import CSV
Fixed
Fixed multiple quiz display issue on same page
Fixed image display issue in result emails
Changes
Patch: Addressed an SQL injection vulnerability related to the 'order' and 'limit' parameters
Changelog published by the developer, in their original language.
