← Back to CVEs

CVE-2019-12517

MEDIUM

6.1

Description

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/13/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

slickquiz_project:slickquiz

Weaknesses (CWE)

CWE-79

References

http://packetstormsecurity.com/files/154439/WordPress-SlickQuiz-1.3.7.1-Cross-Site-Scripting.html(cve@mitre.org)

https://wordpress.org/plugins/slickquiz/#developers(cve@mitre.org)

http://packetstormsecurity.com/files/154439/WordPress-SlickQuiz-1.3.7.1-Cross-Site-Scripting.html(af854a3a-2127-422b-91ae-364da2661108)

https://wordpress.org/plugins/slickquiz/#developers(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.