PickPlugins Question Answer

PickPlugins Question Answer has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 1 is fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (25%). Other recurring categories include Deserialization Of Untrusted Data, Missing Authorization.

1 of the records (25%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, most of them (3) reported by LVT-tholv2k.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage25%

Open

Fixed

Get automatic notifications for all PickPlugins Question Answer vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-32647

Question Answer <= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection

Read the full analysis

Vulnerability Records

4 records


2026-07-27 21:29	PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter PickPlugins Question Answer <= 1.2.73	`CVE-2026-10207`	7.5 High	Adam Rayyan Aryasatya	No
2025-04-14 00:00	Question Answer <= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection PickPlugins Question Answer <= 1.2.70	`CVE-2025-32647`	8.8 High	LVT-tholv2k	No
2025-04-10 00:00	Question Answer <= 1.2.70 - Reflected Cross-Site Scripting PickPlugins Question Answer <= 1.2.70	`CVE-2025-32646`	6.1 Medium	LVT-tholv2k	Yes
2025-04-01 00:00	Question Answer <= 1.2.70 - Missing Authorization PickPlugins Question Answer <= 1.2.70	`CVE-2025-31810`	5.3 Medium	LVT-tholv2k	No

Showing 1–4 of 4 reports