{"containers": {"cna": {"affected": [{"product": "Quiz And Survey Master \u2013 Best Quiz, Exam and Survey Plugin for WordPress", "vendor": "Unknown", "versions": [{"lessThan": "7.3.2", "status": "affected", "version": "7.3.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Shivam Rai"}], "descriptions": [{"lang": "en", "value": "The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-11T10:45:42", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f"}], "source": {"discovery": "EXTERNAL"}, "title": "Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site Scripting ", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24691", "STATE": "PUBLIC", "TITLE": "Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site Scripting "}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Quiz And Survey Master \u2013 Best Quiz, Exam and Survey Plugin for WordPress", "version": {"version_data": [{"version_affected": "<", "version_name": "7.3.2", "version_value": "7.3.2"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Shivam Rai"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24691", "datePublished": "2021-10-11T10:45:42", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2021-10-11T10:45:42", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7D5883C0-CC12-4C0C-9FE5-5AFF5C65D9F9", "versionEndExcluding": "7.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"}, {"lang": "es", "value": "El plugin Quiz And Survey Master de WordPress versiones anteriores a 7.3.2, no escapa de la configuraci\u00f3n de Quiz Url Slug antes de mostrarla en algunas p\u00e1ginas, lo que podr\u00eda permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html no est\u00e1 permitida"}], "id": "CVE-2021-24691", "lastModified": "2021-10-15T16:27:15.527", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-11T11:15:09.163", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}