CVE-2021-20792

🗓️ 18 Aug 2021 05:36:26Reported by jpcertType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 62 Views🌐 WEB

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows remote attacker to inject arbitrary script via unspecified vectors

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-20792	18 Aug 202112:16	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	12 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-20792	18 Aug 202105:36	–	cvelist
EUVD	EUVD-2021-8204	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	JVN#65388002: WordPress Plugin "Quiz And Survey Master" vulnerable to cross-site scripting	10 Aug 202100:00	–	jvn
Japan Vulnerability Notes	WordPress Plugin "Quiz And Survey Master" vulnerable to cross-site scripting	10 Aug 202105:40	–	jvn
Nuclei	WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting	7 Jun 202603:02	–	nuclei
NVD	CVE-2021-20792	18 Aug 202106:15	–	nvd
Prion	Cross site scripting	18 Aug 202106:15	–	prion
RedhatCVE	CVE-2021-20792	22 May 202520:59	–	redhatcve

NVD

Vulners

Node

expresstech quiz_and_survey_masterRange<7.1.14wordpress

[
  {
    "product": "Quiz And Survey Master",
    "vendor": "ExpressTech",
    "versions": [
      {
        "status": "affected",
        "version": "versions prior to 7.1.14"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
quizandsurveymaster	www.quizandsurveymaster.com/
wordpress	www.wordpress.org/plugins/quiz-master-next/
jvn	www.jvn.jp/en/jp/JVN65388002/index.html

Parameter	Position	Path	Description	CWE
s	query param	/wp-admin/admin.php?page=mlw_quiz_list&s="><script>alert(/XSS-s/)</script>&paged="><script>alert(/XSS-paged/)</script>	Reflected XSS due to unsanitised outputs in parameters s and paged in Quiz And Survey Master versions prior to 7.1.14.	CWE-79
paged	query param	/wp-admin/admin.php?page=mlw_quiz_list&s="><script>alert(/XSS-s/)</script>&paged="><script>alert(/XSS-paged/)</script>	Reflected XSS due to unsanitised outputs in parameters s and paged in Quiz And Survey Master versions prior to 7.1.14.	CWE-79

21 Nov 2024 05:47Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.17358

CWE-79