Cross site request forgery (csrf)

php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...