CVE-2025-67595

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The Quiz Maker plugin (versions up to and including 6.7.0.82) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.

Risk Assessment

The risk is that an attacker can perform unauthorized actions in the context of an administrator, potentially leading to changes in quiz settings or data integrity compromise.

Recommendation

Update the Quiz Maker plugin to the latest version that includes a fix for the CSRF vulnerability.

Other vulnerabilities in Quiz Maker

CVE-2026-110379High
The Quiz Maker plugin by Ays Pro (versions up to 6.7.1.91) contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This may allow an attacker to inject malicious script.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.82.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS