CVE-2016-11085

🗓️ 16 Aug 2020 17:17:22Reported by mitreType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

php/qmn_options_questions_tab.php in quiz-master-next plugin before 4.7.9 for WordPress allows CSRF and stored XSS

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2016-11085	16 Aug 202022:55	–	circl
CNVD	WordPress quiz-master-next cross-site request forgery vulnerability	19 Aug 202000:00	–	cnvd
Cvelist	CVE-2016-11085	16 Aug 202017:17	–	cvelist
EUVD	EUVD-2016-2074	7 Oct 202500:30	–	euvd
NVD	CVE-2016-11085	16 Aug 202018:15	–	nvd
Prion	Cross site request forgery (csrf)	16 Aug 202018:15	–	prion
RedhatCVE	CVE-2016-11085	22 May 202511:40	–	redhatcve
WPVulnDB	Quiz And Survey Master < 4.7.9 - Stored Cross-Site Scripting (XSS) & CSRF	15 Dec 201600:00	–	wpvulndb

NVD

Node

Source	Link
security	www.security.dxw.com/advisories/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/

Parameter	Position	Path	Description	CWE
question_name	request body	php/qmn_options_questions_tab.php	CSRF allows stored XSS via the question_name parameter in php/qmn_options_questions_tab.php (quiz-master-next plugin < 4.7.9 for WordPress) due to improper handling of SCRIPT element content.	CWE-352, CWE-79

21 Nov 2024 02:45Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24.3

CVSS 3.16.5

EPSS0.00315