WordPress Plugin Vulnerabilities

Quiz And Survey Master < 6.2.2 - Authenticated Cross-Site Scripting (XSS)

Description

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 6.2.2

References

CVE
CVE-2019-9575
URL
https://lists.openwall.net/full-disclosure/2019/02/05/5
URL
https://security-consulting.icu/blog/2019/02/wordpress-quiz-and-survey-master-xss/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.4 (high)

Miscellaneous

Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
28c4ef2e-abd2-4ee2-9729-8f0cd1aaecbb

Timeline

Publicly Published
2019-02-05 (about 7 years ago)
Added
2019-03-06 (about 7 years ago)
Last Updated
2020-08-13 (about 5 years ago)

Other

Published
Title
Published
2014-08-01
Title
Easy Banners 1.4 - Cross-Site Scripting (XSS)
Published
2024-07-06
Title
Social Media & Share Icons < 2.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-11-24
Title
Community by PeepSo < 6.2.7.0 - Reflected Cross-Site Scripting
Published
2024-07-06
Title
WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2023-11-06
Title
Social Sharing Plugin - Social Warfare < 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode