Medium
Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS
Type: advisorySources: OSV
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-10679
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:55 UTC · Revision 1
Source evidence
Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS
core-osv · Original sourcePublished 25 Mar 2025, 06:00 UTC
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
osv:CVE-2024-10679
Complete source record
{
"id": "e21f3f543ba8bb483bb97e70a0e02ca37e24fc23b55d9e5629345901c721ab65",
"url": "https://osv.dev/vulnerability/CVE-2024-10679",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS",
"summary": "The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"evidence": "osv:CVE-2024-10679",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-10679",
"aliases": [
"CVE-2024-10679"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/quizandsurveymaster/quiz_master_next",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "58ca770e96baf0164d19fe6c2719f0665ee6ddea"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "9.2.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"9.2.0",
"9.1.3",
"9.1.2",
"9.1.1",
"9.1.0",
"9.0.5",
"9.0.2",
"9.0.1",
"9.0.0",
"8.2.3",
"8.2.2",
"8.2.1",
"8.2.0",
"8.1.19",
"8.1.18",
"8.1.17",
"8.1.16",
"8.1.14",
"8.1.13",
"8.1.12",
"8.1.11",
"8.1.10",
"8.1.9",
"8.1.8",
"8.1.7",
"8.1.5",
"8.1.3",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.10",
"8.0.9",
"8.0.8",
"8.0.7",
"8.0.6",
"8.0.5",
"8.0.4",
"8.0.3",
"8.0.2",
"8.0.1",
"8.0",
"7.3.14",
"7.3.13",
"7.3.12",
"7.3.11",
"7.3.10",
"7.3.9",
"6.4.2",
"6.4.1",
"6.4",
"6.3.6",
"6.3.5",
"6.3.3",
"6.3.2",
"6.3.1",
"6.2.1",
"6.2.0",
"6.1.2",
"6.1.1",
"6.1.0",
"6.0.4",
"6.0.3",
"6.0.2",
"6.0.1",
"6.0",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.4",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.7",
"5.1.6",
"5.1.5",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.7",
"5.0.6",
"5.0.5",
"5.0.4",
"5.0.3",
"5.0.2",
"5.0.1",
"5.0.0",
"4.7.10",
"4.7.9",
"4.7.8",
"4.7.7",
"4.7.6",
"4.7.5",
"4.7.4",
"4.7.3",
"4.7.2",
"4.7.1",
"4.7.0",
"4.6.7",
"4.6.6",
"4.6.5",
"4.6.4",
"4.6.3",
"4.6.2",
"4.6.1",
"4.6.0",
"4.5.5",
"4.5.4",
"4.5.3",
"4.5.2",
"4.5.1",
"4.5.0",
"4.4.4",
"4.4.3",
"4.4.2",
"4.4.1",
"4.4.0",
"4.3.1",
"4.3.0",
"4.2.4",
"4.2.3",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.0",
"4.0.1",
"4.0.0",
"3.9.0",
"3.8.2",
"3.8.1",
"3.7.1",
"3.6.1",
"3.5.2",
"3.5.1",
"3.4.1",
"3.3.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10679.json"
}
}
],
"modified": "2026-10-28T02:30:36.789464738Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10679.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-10679",
"https://wpscan.com/vulnerability/001391eb-f181-441d-b777-d9ce098ba143/"
],
"provider_metadata": {
"cna_assigner": "WPScan",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "9.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10679.json"
}
},
"related_cves": [
{
"value": "CVE-2024-10679",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504322,
"published_at": "2025-03-25T06:00:09.267+00:00"
}