CVE-2024-10679
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Mar 25, 2025
Updated: Mar 27, 2025
Summary
CVE-2024-10679 is a vulnerability affecting the Quiz and Survey Master (QSM) WordPress plugin before version 9.2.1. Despite the unfiltered_html capability being disallowed, particularly in multisite setups, this issue fails to sanitize and escape some settings. Consequently, high privilege users, including admins, can execute Stored Cross-Site Scripting attacks. These attacks can lead to unauthorized access, data theft, or website defacement. It is crucial for users to update the plugin as soon as possible to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.