Vulnerabilities / Quiz Maker by AYS / WPSEC-2026-1052
Quiz Maker by AYS <= 6.7.1.91 - Unauthenticated Reflected Cross-Site Scripting via Request URI in Social Share Buttons
Medium 6.1
CWE-79Fixed in 6.7.1.92
- ID
- WPSEC-2026-1052
- Plugin
- Quiz Maker by AYS (quiz-maker)
- Affected
- all versions before 6.7.1.92
- Remediation
- Update to 6.7.1.92 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Quiz Maker by AYS on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz Maker by AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the request URI used to build the social share button links in all versions up to, and including, 6.7.1.91. This is due to the current page URL, taken from the raw HTTP_HOST and REQUEST_URI server variables, being placed into single-quoted href attributes without sanitization or escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link to a page displaying a quiz with social share buttons enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1052/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.92/
- https://wordpress.org/plugins/quiz-maker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS