Question 1

What is the Quiz And Survey Master plugin?

Accepted Answer

What is the Quiz And Survey Master plugin?

Quiz And Survey Master is a popular WordPress plugin used to create and manage quizzes, surveys, exams and other assessments on WordPress websites. With over 2 million downloads, it is one of the top plugins for adding interactive content.

Question 2

What is the vulnerability?

Accepted Answer

What is the vulnerability?

Versions up to 8.1.18 of Quiz And Survey Master contain multiple cross-site request forgery (CSRF) vulnerabilities. This means attackers could trick administrators into clicking malicious links that perform unwanted actions like showing hidden contact form fields or deleting quiz results.

Question 3

How serious is this vulnerability?

Accepted Answer

How serious is this vulnerability?

The vulnerabilities are considered medium severity with a CVSS base score of 5.4. While no specific exploit has been reported, the flaws do pose risks of sensitive data exposure, data loss, and disruption of site functions.

Question 4

What versions of the plugin are affected?

Accepted Answer

What versions of the plugin are affected?

Quiz And Survey Master versions up to and including 8.1.18 contain the vulnerabilities. Version 8.1.19 fixes the issues by adding proper validation to prevent CSRF attacks.

Question 5

What should I do if I use this plugin?

Accepted Answer

What should I do if I use this plugin?

Users are strongly advised to update to version 8.1.19 as soon as possible. You can do this manually or enable automatic updates for plugins. Also check your quiz and contact form settings for any unauthorized changes.

Question 6

Are there any workarounds short of updating?

Accepted Answer

Are there any workarounds short of updating?

There are no official workarounds available besides updating to the latest fixed version. Disabling the plugin also stops the vulnerabilities but means losing its functionality.

Question 7

Could my site have been compromised?

Accepted Answer

Could my site have been compromised?

If you were running a vulnerable version, it's possible. Check quiz settings and submissions along with form data for any suspicious changes. Malicious changes may be subtle.

Question 8

Why do WordPress plugins have so many vulnerabilities?

Accepted Answer

Why do WordPress plugins have so many vulnerabilities?

The open source nature of WordPress and its ecosystem leads to widespread use of third-party plugins. This provides a large attack surface. Proper validation and security practices by developers is crucial.

Question 9

How can I stay on top of WordPress security?

Accepted Answer

How can I stay on top of WordPress security?

Enable auto updates, regularly check the WordPress security feed, use a security plugin to scan for vulnerabilities, and consider a managed hosting provider who can monitor and apply updates quickly.

Question 10

Who discovered and reported this vulnerability?

Accepted Answer

Who discovered and reported this vulnerability?

The vulnerability was discovered by the WordPress security team Wordfence and responsibly disclosed to the Quiz And Survey Master developers who promptly released a fix in version 8.1.19.

quiz and survey master

WordPress Plugin Vulnerability Report – Quiz And Survey Master – Multiple Cross-Site Request Forgery

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy