CVE-2016-11085

Name of the Vulnerable Software and Affected Versions: Quiz-master-next plugin versions prior to 4.7.9 for WordPress

Description: The issue allows for Cross-Site Request Forgery (CSRF) with resultant stored Cross-Site Scripting (XSS) via the question name parameter. This occurs because the js/admin question.js file mishandles parsing inside of a SCRIPT element.

Recommendations: For versions prior to 4.7.9, update to version 4.7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the question name parameter in the affected API endpoint until the issue is resolved.