CVE-2016-11085

php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...

CVE-2016-11085

php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...

CVE-2016-11085

The CVE-2016-11085 vulnerability affects the WordPress plugin Quiz Master Next (quiz-master-next) pre-4.7.9. The issue is a CSRF that results in stored XSS via the question_name parameter, caused by how js/admin_question.js parses within a SCRIPT element. Evidence from multiple sources confirms t...