CVE-2021-24701

The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f7b95789-43f2-42a5-95e6-eb7accbd5ed3

References

• CVE Record
• NVD entry

Related

• CVE-2021-24700
• CVE-2021-24702
• CVE-2021-24699
• CVE-2021-24703
• CVE-2021-24698
• CVE-2021-24704