Security readout for executives and security teams
Plain-English summary
This is a reflected XSS flaw in the WordPress Quiz And Survey Master plugin before 7.1.18. A malicious link could run script in an administrator’s browser if they are logged in and open it. The business risk is targeted admin compromise, not broad automatic server takeover based on the provided sources.
Executive priority
Treat as a targeted phishing-enabled WordPress admin risk. Prioritize patching if the plugin is installed, especially on public or business-critical sites. Urgency is moderate because user interaction is required and no active exploitation evidence is cited.
Technical view
The plugin failed to sanitize or escape the result_id parameter when rendering an existing quiz result page, causing CWE-79 reflected XSS. The cited description says this could enable privilege escalation by inducing a logged-in admin to open a malicious link. No CVSS score is provided in the source bundle.
Likely exposure
Exposure is likely limited to WordPress sites running Quiz And Survey Master before 7.1.18. Risk is higher where administrators routinely access quiz result pages or could be targeted with crafted links while authenticated.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires social engineering or another way to get a logged-in administrator to open a malicious link.
Researcher notes
Focus review on result page rendering of result_id and output encoding. The public bundle identifies CWE-79 and privilege escalation potential but does not provide CVSS, exploit maturity, or detailed patch notes beyond versions before 7.1.18.
Mitigation direction
- Upgrade Quiz And Survey Master to version 7.1.18 or later.
- Check WPScan or vendor guidance for any additional hardening instructions.
- Limit WordPress administrator access to trusted users only.
- Train administrators to avoid unexpected quiz result links.
Validation and detection
- Inventory WordPress sites using Quiz And Survey Master.
- Confirm installed plugin versions are 7.1.18 or later.
- Review logs for unusual quiz result requests containing encoded script-like input.
- Confirm result pages encode user-controlled parameters after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24368 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/7f2fda5b-45a5-4fc6-968f-90bc9674c999CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.