Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2021-24691
CVE-2021-24691:
WordPress vulnerability analysis and mitigation
Overview
The Quiz And Survey Master WordPress plugin before version 7.3.2 contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24691. The vulnerability was discovered by security researcher Shivam Rai and was publicly disclosed on September 13, 2021. This security issue affects the quiz-master-next plugin, specifically impacting administrators and users with high privileges (WPScan).
Technical details
The vulnerability stems from improper output escaping of the Quiz Url Slug setting in certain pages. This security flaw allows high-privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.5 (low severity) and is classified under CWE-79, falling into the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).
Impact
When exploited, this vulnerability allows attackers with administrative access to inject malicious JavaScript code through the Quiz Url Slug setting. The injected code gets executed when users edit quizzes or access the Quizzes/Surveys page in the WordPress admin panel (WPScan).
Mitigation and workarounds
The vulnerability has been patched in version 7.3.2 of the Quiz And Survey Master plugin. Users are advised to update their installations to this version or later to mitigate the security risk (WPScan).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management