Skip to content
Sign in
6.1 Medium

CVE-2024-10679 The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which…

Description

The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products and versions

Product Affected versions Fixed in
Quiz and Survey Master (QSM) 9.2 earliest → < 9.2.1 9.2.1

Other CVEs of Quiz and Survey Master (QSM)

The 14 CVEs of Quiz and Survey Master (QSM) →
CVE-2026-79615 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question… 2.7 Low CVE-2026-14825 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before… 2.7 Low CVE-2026-14826 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the… 2.7 Low CVE-2026-14824 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before… 4.8 Medium
Track this CVE