CVE-2022-4032

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4

Description The issue arises from insufficient input sanitization and output escaping, allowing iframe tags to be injected via the question[id] parameter. This enables unauthenticated attackers to inject iFrames into pages, which will execute when a user accesses the injected page.

Recommendations For versions up to, and including, 8.0.4, consider disabling the question[id] parameter until a patch is available to prevent iFrame injection. Restrict access to the affected plugin to minimize the risk of exploitation. Avoid using the question[id] parameter in affected pages until the issue is resolved.