CVE-2024-6025
📋 TL;DR
The Quiz and Survey Master WordPress plugin before version 9.0.5 has insufficient input sanitization in quiz settings, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when other users view the affected quiz pages, enabling stored cross-site scripting attacks.
💻 Affected Systems
- Quiz and Survey Master WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with contributor access could inject malicious JavaScript that steals administrator session cookies, leading to full site compromise and potential data exfiltration.
Likely Case
Malicious contributors inject advertising scripts, redirects, or deface quiz pages viewed by other users.
If Mitigated
With proper user role management and content security policies, impact is limited to minor page manipulation within quiz content.
🎯 Exploit Status
Exploitation requires contributor-level access; proof-of-concept details are publicly available in vulnerability disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.5
Vendor Advisory: https://wordpress.org/plugins/quiz-master-next/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Quiz and Survey Master'. 4. Click 'Update Now' if available, or download version 9.0.5+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Restrict User Roles
allTemporarily remove contributor editing privileges or downgrade suspicious users to subscriber role.
Content Security Policy
allImplement CSP headers to restrict script execution from untrusted sources.
Header set Content-Security-Policy "script-src 'self'" in .htaccess or web server config
🧯 If You Can't Patch
- Disable the Quiz and Survey Master plugin entirely until patching is possible.
- Audit and remove any suspicious quiz content created by contributors.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Quiz and Survey Master → View version details. If version is below 9.0.5, system is vulnerable.Check Version:
wp plugin list --name='quiz-and-survey-master' --field=versionVerify Fix Applied:
Confirm plugin version is 9.0.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual quiz creation/modification by contributor users
- POST requests to /wp-admin/admin.php?page=mlw_quiz_options containing script tags
Network Indicators:
- HTTP traffic containing malicious script payloads in quiz parameter submissions
SIEM Query:
source="wordpress.log" AND ("mlw_quiz_options" OR "qsm") AND ("<script>" OR "javascript:")