Quiz And Survey Master < 9.0.2 – Contributor+ Stored XSS | CVE 2024-4934 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

1. Go to to Quizzes & Surveys
2. Add/edit a question on a Quiz, and put the following payload in the answer field: &lt;img src=x onerror=alert(/XSS/)&gt;
5. Add the Quiz to a post (via Add block for example) and save

The XSS will be triggered when any user will edit the post and click on the Quiz

Affects Plugins

quiz-master-next

Fixed in 9.0.2

References

CVE

URL

https://research.cleantalk.org/CVE-2024-4934/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krugov Artyom

Submitter

Krugov Aryom

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

a2270ee1-3211-4b16-b3d7-6cdd732f7155

Timeline

Publicly Published

2024-06-10 (about 1 year ago)

Added

2024-06-10 (about 1 year ago)

Last Updated

2024-06-10 (about 1 year ago)

Other

Published

Title

Published

2024-09-30

Title

TNC PDF viewer < 3.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting

Published

2025-01-29

Title

WP Post List Table < 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-29

Title

EthereumICO < 2.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode

Published

2025-01-16

Title

ChatGPT Open AI Images & Content for WooCommerce <= 2.2.0 - Reflected Cross-Site Scipting

Published

2025-06-05

Title

Booking Ultra Pro < 1.1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting