Description

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker is prone to multiple vulnerabilities, including iFrame injection and input validation bypass vulnerabilities. Exploiting these issues could allow an attacker to inject iFrames in pages that will execute whenever a user accesses an injected page, or to send values other than the expected type. WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker version 8.0.4 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 8.0.5 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quiz-master-next/quiz-and-survey-master-804-unauthenticated-iframe-injection-via-paragraph-and-short-answer

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quiz-master-next/quiz-and-survey-master-804-improper-input-validation

https://plugins.svn.wordpress.org/quiz-master-next/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Contact Form & SMTP Plugin for WordPress by PirateForms Cross-Site Scripting (2.5.1)

PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1975)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-4303)

Oracle Database Server CVE-2010-0852 Vulnerability (CVE-2010-0852)

WordPress Plugin Welcart e-Commerce PHP Object Injection (1.9.35)

Severity

High

Classification

CVE-2022-4032 CVE-2022-4033 CWE-80 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update