QSM / Quiz And Survey Master Core Changelog

Sin fecha · 15 versiones

1. 11.3.0

   Última

   2 correcciones1 de seguridad

   Ocultar

   Corregido

   • Fixed the Start button submitting the quiz in the new render.
   • Fixed the answer_array error in quick results in the legacy version.

   Seguridad

   • Fixed Contributor+ SQL injection via stored quiz page data (qpages).

2. 11.2.9

   1 nuevo2 correcciones2 de seguridad

   Ocultar

   Nuevo

   • Added an option to disable correct-answer highlighting for wrong responses.

   Corregido

   • Text/HTML, Opt-in, and Captcha fields no longer affect score totals.
   • Improved score accuracy when Text/HTML sections are hidden by conditional logic, including the admin Results column.

   Seguridad

   • Fixed stored XSS in the question featured image field.
   • Fixed PHP Object Injection in quiz Contact tab settings.

3. 11.2.8

   1 corrección3 de seguridad

   Ocultar

   Corregido

   • Fixed issue where the QSM block creates blank question copies when a quiz is embedded twice.

   Seguridad

   • Fixed stored XSS via question length settings and resolved a question-save IDOR vulnerability.
   • Blocked PHP Object Injection vulnerabilities via the quiz option element.
   • Prevented unauthenticated shortcode injection flaws via the result unique_id.

4. 11.2.7

   1 mejora3 correcciones1 de seguridad

   Mostrar

   Mejora

   • Improved icon display consistency when reloading pages.

   Corregido

   • Respect the Draft/Published status when saving quiz questions.
   • Enforce the question limit when pagination is disabled.
   • Ensure quiz responses are saved correctly when the quiz page is cached.

   Seguridad

   • Improved input handling in the Audit Trail to prevent potential cross-site scripting issues.

5. 11.2.6

   1 de seguridad

   Mostrar

   Seguridad

   • Improved validation of user inputs and query parameters to prevent unauthenticated enumeration of quiz results.

6. 11.2.5

   3 mejoras3 correcciones1 de seguridad

   Mostrar

   Mejora

   • Prevented automatic scrolling to the quiz section when loading a homepage.
   • Set duplicated quizzes to Draft status instead of Published.
   • Improved the Default Questions popup UI in the admin panel.

   Corregido

   • Fixed missing page timer settings for pages without a qpages entry.
   • Fixed JavaScript errors when the questions-per-page setting is 0.
   • Fixed PHP warnings that occurred when duplicating or submitting a quiz.

   Seguridad

   • Improved QSM login security by adding login attempt rate limiting to prevent repeated failed password attempts.

7. 11.2.4

   2 correcciones4 de seguridad

   Mostrar

   Corregido

   • Fixed missing translations for question type names during Question Bank import.
   • Fixed quiz navigator jumping to incorrect pages and question numbers in the new renderer.

   Seguridad

   • Fixed a Contributor+ ownership bypass by validating author records instead of post meta.
   • Fixed a Contributor+ information disclosure issue in REST endpoints by enforcing per-quiz ownership checks
   • Restricted the Question Bank picker and CSV import to quizzes owned by the current user
   • Added direct file access protection and sanitized lazy-loaded answer IDs.

8. 11.2.3

   1 nuevo2 mejoras2 correcciones1 cambio

   Mostrar

   Nuevo

   • Added default settings for newly created questions.

   Mejora

   • Added support for loading custom CSS on the results page.
   • Improved bulk import functionality with CSV question download handling.

   Corregido

   • Resolved the processing message display configuration issue.
   • Fixed a cookie-related issue affecting embedded quizzes with randomized questions.

   Cambios

   • Patch: Improved API request validation for JavaScript alerts involving the question_title parameter.

9. 11.2.2

   4 de seguridad

   Mostrar

   Seguridad

   • Fixed a Contributor+ stored XSS in the Polar question type where the "required" setting was emitted into an unquoted HTML attribute (CVE-2026-14824). Credit: Meher Sudhakar Abbireddi.
   • Fixed a Contributor+ cross-quiz IDOR write in the quiz text-message AJAX handler by enforcing a per-quiz ownership check (CVE-2026-14825). Credit: Revanth Hari Narayana Matte.
   • Fixed a Contributor+ cross-quiz information disclosure in the email and results REST GET endpoints by enforcing a per-quiz ownership check (CVE-2026-14826). Credit: Revanth Hari Narayana Matte.
   • Fixed a Contributor+ SQL injection via the "randon_category" quiz option by sanitizing category IDs before the query (CVE-2026-15963). Credit: PRISM.

10. 11.2.1

    1 nuevo1 mejora1 corrección1 cambio

    Mostrar

    Nuevo

    • Added an option to display the latest result in the Limited Entry Attempts feature.

    Mejora

    • Improved Answer Editor filters and Results Answer attributes.

    Corregido

    • Fixed a JavaScript bug affecting the answer limit for Multiple Choice question types.

    Cambios

    • Patch: Improved API request validation for the question_title parameter.

11. 11.2.0

    1 nuevo2 mejoras1 corrección1 cambio

    Mostrar

    Nuevo

    • Added the ability to configure page limits for individual pages when using manual pagination

    Mejora

    • Added support for translating quiz links generated with the "quiz_link" shortcode in WPML
    • Improved Media page UI compatibility with WordPress 7

    Corregido

    • Resolved an issue where the progress bar was not displaying correctly for flashcard questions

    Cambios

    • Patch: Fixed a stored Cross-Site Scripting (XSS) vulnerability involving the "question_title" and "unique_id" parameters

12. 11.1.5

    2 nuevos2 mejoras

    Mostrar

    Nuevo

    • Added the %QSM_ADMIN_EMAIL% template variable to include the admin email in email templates
    • Added %QSM_START_QUIZ_DATE% and %QSM_END_QUIZ_DATE% template variables to display the quiz start and end dates

    Mejora

    • Improved validation and security measures when saving quiz email templates
    • Strengthened security checks for saving email and result templates

13. 11.1.4

    2 mejoras1 corrección1 cambio

    Mostrar

    Mejora

    • Improved QSM Core UI compatibility with WordPress 7.0
    • Added category permission validation with enhanced UI error handling

    Corregido

    • Fixed issues with bulk question imports and file reset functionality

    Cambios

    • Patch: Resolved an IDOR vulnerability in REST endpoints that could allow unauthorized quiz and question modifications

14. 11.1.3

    2 mejoras1 corrección1 cambio

    Mostrar

    Mejora

    • Improved the question hints UI in the new quiz renderer
    • Strengthened security validation to get all the questions and user login functions

    Corregido

    • Resolved result display issues with random questions and answers

    Cambios

    • Patch: Fixed a Cross-Site Scripting (XSS) vulnerability in rich answer type questions

15. 11.1.2

    1 nuevo2 mejoras2 correcciones1 cambio

    Mostrar

    Nuevo

    • Added option to enable/disable public result sharing links

    Mejora

    • Improved date question type real time validation
    • Added support for correct answer info in bulk question import CSV

    Corregido

    • Fixed multiple quiz display issue on same page
    • Fixed image display issue in result emails

    Cambios

    • Patch: Addressed an SQL injection vulnerability related to the 'order' and 'limit' parameters