CVE-2021-24691

4.8 mediumEPSS 0.6%

Medium (4.8) in expresstech quiz and survey master. EPSS 0.6% chance of exploitation in the next 30 days.

The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-10-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

expresstech:quiz_and_survey_master

References

https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f
https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f

Check your stack JSON