# Quiz Maker by AYS <= 6.7.1.91 - Unauthenticated Reflected Cross-Site Scripting via Request URI in Social Share Buttons

- **ID:** WPSEC-2026-1052
- **Plugin:** Quiz Maker by AYS (`quiz-maker`), https://wordpress.org/plugins/quiz-maker/
- **Affected versions:** all versions before 6.7.1.92
- **Fixed in:** 6.7.1.92 (Update to 6.7.1.92 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-maker
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1052/

## Description

The Quiz Maker by AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the request URI used to build the social share button links in all versions up to, and including, 6.7.1.91. This is due to the current page URL, taken from the raw HTTP_HOST and REQUEST_URI server variables, being placed into single-quoted href attributes without sanitization or escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link to a page displaying a quiz with social share buttons enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1052/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.92/
- https://wordpress.org/plugins/quiz-maker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1052/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.