CVE-2024-8758
📋 TL;DR
This vulnerability allows administrators or other high-privilege users in WordPress to inject malicious scripts into Quiz and Survey Master plugin settings. The stored XSS payload executes when other users view affected pages, even when unfiltered_html is disabled in multisite configurations.
💻 Affected Systems
- Quiz and Survey Master (QSM) WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to site takeover, data theft, or malware distribution to visitors.
Likely Case
Privileged user injects malicious scripts that steal session cookies or redirect users to phishing sites.
If Mitigated
Limited to authenticated admin users only, with minimal impact if proper user access controls are enforced.
🎯 Exploit Status
Exploitation requires admin-level access; stored XSS payloads execute when users view affected plugin pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.1.3
Vendor Advisory: https://wpscan.com/vulnerability/d74ecae2-3a1e-4fc7-9dd3-04cef631ecd9/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Quiz and Survey Master'. 4. Click 'Update Now' if available, or download version 9.1.3+ from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched.
wp plugin deactivate quiz-master-next
Restrict Admin Access
allLimit administrative accounts to trusted users only.
🧯 If You Can't Patch
- Implement strict user access controls and monitor admin activities.
- Deploy web application firewall with XSS protection rules.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins.Check Version:
wp plugin get quiz-master-next --field=versionVerify Fix Applied:
Confirm plugin version is 9.1.3 or higher in plugin details.📡 Detection & Monitoring
Log Indicators:
- Unusual admin user modifications to QSM settings
- JavaScript payloads in plugin configuration logs
Network Indicators:
- Suspicious script tags in HTTP responses from QSM pages
SIEM Query:
source="wordpress" AND "quiz and survey master" AND ("update" OR "settings") AND ("script" OR "javascript")