CVE-2019-17599

The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

• CWE-79

• https://github.com/QuizandSurveyMaster/quiz_master_next/issues/795Exploit, Third Party Advisory
• https://github.com/QuizandSurveyMaster/quiz_master_next/pull/796Third Party Advisory
• https://wordpress.org/plugins/quiz-master-next/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/9977Exploit, Third Party Advisory
• https://github.com/QuizandSurveyMaster/quiz_master_next/issues/795Exploit, Third Party Advisory
• https://github.com/QuizandSurveyMaster/quiz_master_next/pull/796Third Party Advisory
• https://wordpress.org/plugins/quiz-master-next/#developersRelease Notes
• https://wpvulndb.com/vulnerabilities/9977Exploit, Third Party Advisory

Published

Dec 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17592The csv-parse module before 4.4.6 for Node.js is vulnerable …7.5
• CVE-2019-17593JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to …8.8
• CVE-2019-17594There is a heap-based buffer over-read in the _nc_find_entry…5.3
• CVE-2019-17595There is a heap-based buffer over-read in the fmt_entry func…5.4
• CVE-2019-17596Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an …7.5
• CVE-2019-17598An issue was discovered in Lightbend Play Framework 2.5.x th…7.5
• CVE-2019-1760A vulnerability in Performance Routing Version 3 (PfRv3) of …6.8
• CVE-2019-17600Intelbras IWR 1000N 1.6.4 devices allow disclosure of the ad…9.8
• CVE-2019-17601In MiniShare 1.4.1, there is a stack-based buffer overflow v…9.8
• CVE-2019-17602An issue was discovered in Zoho ManageEngine OpManager befor…9.8
• CVE-2019-17603Ene.sys in Asus Aura Sync through 1.07.71 does not properly …7.8
• CVE-2019-17604An Insecure Direct Object Reference (IDOR) vulnerability in …4.3