The issue allows an attacker to execute arbitrary HTML and JavaScript code. This can occur via the `from` or `till` parameter, and/or the `quiz id` parameter, in the admin/quiz-options-page.php component. The attack vector involves a reflected XSS that may execute when an Administrator clicks on a malicious URL while logged in.