TI-2021-04018 Aliases CVE-2021-20792 GHSA-pv46-7c32-rmg5

Cross-site scripting in ExpressTech Quiz And Survey Master

LOW 33CWE-79Published 2021-08-18 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

Why it matters now

EPSS 0.02915 87th percentileScored 2026-11-07

Fix Fixed Quiz And Survey Master (ExpressTech): 7.1.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ExpressTech	Quiz And Survey Master	before 7.1.14	7.1.14	Patch available	CNA

Quiz And Survey Master VendorExpressTech Affected before 7.1.14 Fixed in 7.1.14 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:expresstech:quiz_and_survey_master::::::wordpress::*	before 7.1.14	Vulnerable	ExpressTech

cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:* Versions before 7.1.14 Vulnerable ·ExpressTech

Remediation

Fix · CNA Quiz And Survey Master (ExpressTech) Fixed in 7.1.14

Timeline

2026-10-02 Threatist record created from CVE-2021-20792
2026-10-03 Alias added: GHSA-pv46-7c32-rmg5

References

Patch 1

https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php

Advisory 1

https://jvn.jp/en/jp/JVN65388002/index.html

Other 2

TI-2020-18392 An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. CVSS 3.1CRITICAL 9.9
TI-2024-05207 Quiz And Survey Master < 9.0.2 - Contributor+ SQLi CVSS 3.1HIGH 8.8
TI-2024-05583 Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.5
TI-2024-09897 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS CVSS 3.1MEDIUM 6.1
TI-2024-05932 Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
TI-2024-04590 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences