CVE-2016-11085

🗓️ 16 Aug 2020 17:17:22Reported by mitreType

cve🔗 web.nvd.nist.gov👁 67 Views🌐 WEB

php/qmn_options_questions_tab.php in quiz-master-next plugin before 4.7.9 for WordPress allows CSRF and stored XSS

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2016-11085	16 Aug 202022:55	–	circl
CNVD	WordPress quiz-master-next cross-site request forgery vulnerability	19 Aug 202000:00	–	cnvd
Cvelist	CVE-2016-11085	16 Aug 202017:17	–	cvelist
EUVD	EUVD-2016-2074	7 Oct 202500:30	–	euvd
Mend	CVE-2016-11085	16 Aug 202017:17	–	mend
NVD	CVE-2016-11085	16 Aug 202018:15	–	nvd
Prion	Cross site request forgery (csrf)	16 Aug 202018:15	–	prion
Positive Technologies	PT-2020-8014	16 Aug 202000:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2016-11085: Improper Neutralization of Input During Web Page Generation	16 Aug 202000:00	–	rapid7
RedhatCVE	CVE-2016-11085	22 May 202511:40	–	redhatcve

NVD

Node

Source	Link
security	www.security.dxw.com/advisories/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/

Parameter	Position	Path	Description	CWE
question_name	request body	php/qmn_options_questions_tab.php	CSRF leading to stored XSS via the question_name parameter in php/qmn_options_questions_tab.php (quiz-master-next WordPress plugin) due to JS parsing mishandling inside a SCRIPT element.	CWE-352, CWE-79

17 Jun 2026 00:40Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24.3

CVSS 3.16.5

EPSS0.01016