{
 "id": "WPSEC-2026-1052",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1052/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1052/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1052/index.md",
 "title": "Quiz Maker by AYS <= 6.7.1.91 - Unauthenticated Reflected Cross-Site Scripting via Request URI in Social Share Buttons",
 "description": "The Quiz Maker by AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the request URI used to build the social share button links in all versions up to, and including, 6.7.1.91. This is due to the current page URL, taken from the raw HTTP_HOST and REQUEST_URI server variables, being placed into single-quoted href attributes without sanitization or escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link to a page displaying a quiz with social share buttons enabled.",
 "plugin": {
  "slug": "quiz-maker",
  "name": "Quiz Maker by AYS",
  "full_name": "Quiz Maker by AYS",
  "wordpress_org": "https://wordpress.org/plugins/quiz-maker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-maker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-maker"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.7.1.92",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.7.1.92"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.7.1.92",
 "remediation": "Update to 6.7.1.92 or later.",
 "fix_released": "2026-10-15T09:20:25+00:00",
 "published": "2026-10-16T10:47:15+00:00",
 "updated": "2026-10-16T09:50:05.547423+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1052/",
  "https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.92/",
  "https://wordpress.org/plugins/quiz-maker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-maker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}