Medium severity6.5NVD Advisory· Published Aug 16, 2020· Updated Jun 17, 2026

CVE-2016-11085

Description

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Expresstech/Quiz And Survey Master
cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*
Range: <4.7.9
WordPress/quiz-master-next plugindescription
WordPress/Quiz Master Nextllm-fuzzy
Range: <4.7.9
Package: https://wordpress.org/plugins/quiz-master-next

Patches

Vulnerability mechanics

References

security.dxw.com/advisories/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000