CVE-2026-110379

HighCVSS 7.1

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

The Quiz Maker plugin by Ays Pro (versions up to 6.7.1.91) contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This may allow an attacker to inject malicious script.

Risk Assessment

An attacker could execute arbitrary JavaScript in the victim's browser, potentially leading to session theft or other actions in the user's context.

Recommendation

Update the Quiz Maker plugin to the latest version that fixes this vulnerability. Additionally, consider implementing input filtering mechanisms.

Other vulnerabilities in Quiz Maker

CVE-2025-67595Medium
The Quiz Maker plugin (versions up to and including 6.7.0.82) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS