nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-6390 CVE-2024-6390
MEDIUM
Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS
Record summary
CVE-2024-6390 has a selected CVSS score of 5.9 (medium).
Description
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Quiz and Survey Master (QSM)Default status: unaffected | CVE List | Before 9.1.0 | affected |
quiz_and_survey_masterBrowse expresstech / quiz_and_survey_masterDefault status: unaffected | CVE List | Before 9.1.0 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/00586687-33c7-4d84-b606-0478b1063d24