WordPress CVEs

Description

Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php.

Affected WordPress components

• mtouch-quiz Plugin · mtouch-quiz
  Confirmed match Homeless
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• mtouch_quiz_project mtouch_quiz — Up to and including 3.0.6

References

• secunia.com http://secunia.com/advisories/57491
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/91949
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/91950
• security.dxw.com https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/ Exploit
• wordpress.org https://wordpress.org/plugins/mtouch-quiz/changelog/ Patch
• nvd.nist.gov Official NVD record