CVE-2024-6879
📋 TL;DR
This vulnerability in the Quiz and Survey Master WordPress plugin allows users with contributor-level permissions or higher to inject malicious scripts into quiz fields. When these quizzes are displayed on pages or posts, the scripts execute in visitors' browsers, enabling stored cross-site scripting attacks. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Quiz and Survey Master (QSM) WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Malicious contributors or compromised accounts inject scripts to steal user session data or display unwanted content to visitors.
If Mitigated
With proper user role management and input validation, impact is limited to low-privilege script execution that doesn't compromise the server.
🎯 Exploit Status
Exploitation requires contributor-level access; proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.1.1
Vendor Advisory: https://wpscan.com/vulnerability/4da0b318-03e7-409d-9b02-f108e4232c87/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Quiz and Survey Master'. 4. Click 'Update Now' if available. 5. Alternatively, download version 9.1.1+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Restrict User Roles
allLimit contributor and author roles to trusted users only; consider removing unnecessary accounts.
Disable Plugin
linuxTemporarily deactivate Quiz and Survey Master plugin until patched.
wp plugin deactivate quiz-master-next
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in quiz fields.
- Regularly audit user accounts and remove unnecessary contributor/author roles.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Quiz and Survey Master → Version number. If below 9.1.1, you're vulnerable.Check Version:
wp plugin get quiz-master-next --field=versionVerify Fix Applied:
Confirm plugin version is 9.1.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual quiz field modifications by contributor-level users
- Script tags or JavaScript in quiz content submissions
Network Indicators:
- Unexpected external script loads from quiz pages
- Suspicious outbound connections from quiz visitors
SIEM Query:
source="wordpress.log" AND ("quiz-master-next" OR "qsm") AND ("update" OR "edit" OR "inject")