The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
References
Link | Resource |
---|---|
https://github.com/QuizandSurveyMaster/quiz_master_next/issues/795 | Exploit Third Party Advisory |
https://github.com/QuizandSurveyMaster/quiz_master_next/pull/796 | Third Party Advisory |
https://wordpress.org/plugins/quiz-master-next/#developers | Release Notes |
https://wpvulndb.com/vulnerabilities/9977 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-12-13T13:30:03
Updated: 2019-12-13T16:06:03
Reserved: 2019-10-15T00:00:00
Link: CVE-2019-17599
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-12-13T14:15:12.297
Modified: 2019-12-17T21:06:27.183
Link: CVE-2019-17599
JSON object: View
Redhat Information
No data.
CWE