CVE-2022-4032

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-403208.8cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.CVE-2022-403226.1SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.CVE-2022-403236.1SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.CVE-2022-403246.1SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.CVE-2022-403256.1SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.CVE-2022-40335.3The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to,CVE-2022-403378.8OASES (aka Open Aviation Strategic Engineering System) 8.8.0.2 allows attackers to execute arbitrary code via the Open Print Folder menu.CVE-2022-40347.8The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it pos CVE-2022-403418.8mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a craf CVE-2022-403479.8SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' paramet CVE-2022-403485.4Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, all CVE-2022-40356.1The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions