CVE-2024-10679: Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS
Published Mar 25, 2025
·Updated
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
2 affected components
Quiz and Survey Master QSM<9.2.1
ExpressTech Quiz And Survey Master Wordpress<9.2.1
Event History
Mar 25, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-10679?
CVE-2024-10679 has a medium severity rating due to its potential for stored Cross-Site Scripting attacks.
2
How do I fix CVE-2024-10679?
To fix CVE-2024-10679, update the Quiz and Survey Master plugin to version 9.2.1 or later.
3
Who is affected by CVE-2024-10679?
CVE-2024-10679 affects users of the Quiz and Survey Master plugin prior to version 9.2.1 on WordPress.
4
What type of vulnerability is CVE-2024-10679?
CVE-2024-10679 is a stored Cross-Site Scripting (XSS) vulnerability.
5
Can unprivileged users exploit CVE-2024-10679?
No, only high privilege users such as admins can exploit CVE-2024-10679.