CVE-2024-6879

Published: Aug 26, 2024Modified: May 17, 2025

4.7

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.

Affected (1)

Products: Expresstech: Quiz And Survey Master

1 product

Quiz And Survey Master

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Expresstech Quiz And Survey Master	Before 9.1.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://wpscan.com/vulnerability/4da0b318-03e7-409d-9b02-f108e4232c87/

Source: contact@wpscan.com

ExploitThird Party Advisory

Timeline

No history available yet.