PT-2021-16088 · WordPress · Hd Quiz

Asif Nawaz Minhas · Published 2021-08-23 · Updated 2021-08-26 · CVE-2021-24571

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HD Quiz WordPress plugin versions prior to 1.8.4

Description The issue is related to Stored Cross-Site Scripting, where some answers are not properly escaped before being outputted in attributes when generating a quiz. This could lead to potential security issues.

Recommendations For versions prior to 1.8.4, update to version 1.8.4 or later to resolve the issue. As a temporary workaround, consider disabling the quiz generation feature until a patch is available. Restrict access to the quiz module to minimize the risk of exploitation. Avoid using unescaped answers in the affected plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24571

Affected Products

Hd Quiz

References · 4

• 🔥 https://wpscan.com/vulnerability/377fd65f-3a8c-4f7a-9e40-046d52ec0eef · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24571 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24571 · Vendor Advisory
• https://t.me/cibsecurity/27689 · Telegram Post