PT-2022-25346 · WordPress · Quiz/Survey Master

Andreas Krüger + 1 · Published 2022-11-29 · Updated 2022-12-02 · CVE-2022-4032

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4

Description The issue arises from insufficient input sanitization and output escaping, allowing iframe tags to be injected via the question[id] parameter. This enables unauthenticated attackers to inject iFrames into pages, which will execute when a user accesses the injected page.

Recommendations For versions up to, and including, 8.0.4, consider disabling the question[id] parameter until a patch is available to prevent iFrame injection. Restrict access to the affected plugin to minimize the risk of exploitation. Avoid using the question[id] parameter in affected pages until the issue is resolved.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2022-4032

Affected Products

Quiz/Survey Master

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-4032 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4032 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/38720 · Telegram Post
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-4032 · Note
• https://t.me/cibsecurity/53677 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b901b3f8-8bbd-42ef-8e0c-de6d09c4950f?source=cve · Note
• https://t.me/cvenotify/38925 · Telegram Post