Skip to content
Noroxi

Quiz Maker by AYS

quiz-maker · plugin

Known security vulnerabilities for Quiz Maker by AYS. Find out in seconds which version runs on your site with WP Lens.

14 known vulnerabilities

2 critical · 11 exploitable without logging in · 2 with public exploit code · latest May 2, 2026

Listed on wordpress.org · latest 6.7.1.87 · last updated Oct 2, 2026 · 20K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-30774unauthenticated · needs a click≤ 6.6.8.7

    WordPress Quiz Maker plugin <= 6.6.8.7 - SQL Injection vulnerability

    Critical 9.8

  • CVE-2024-6028unauthenticated≤ 6.5.8.3

    Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

    Critical 9.8

  • CVE-2025-12426unauthenticated≤ 6.7.0.80

    Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure

    High 7.5

  • CVE-2025-58015unauthenticated≤ 6.7.0.65

    WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability

    High 7.5

  • CVE-2025-10042unauthenticated≤ 6.7.0.56

    Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

    High 7.5

  • CVE-2024-22027login required

    Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a

    Medium 6.5

  • CVE-2026-2384contributor+≤ 6.7.1.7

    Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 6.4

  • CVE-2026-6817unauthenticated≤ 6.7.1.29

    Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'

    Medium 5.8

  • CVE-2023-23985unauthenticated≤ 6.3.9.4

    WordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing

    Medium 5.3

  • CVE-2024-1079unauthenticated≤ 6.5.2.4

    Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval

    Medium 5.3

  • CVE-2026-32342unauthenticated · needs a click≤ 6.7.1.2

    WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2025-67595unauthenticated · needs a click≤ 6.7.0.82

    WordPress Quiz Maker plugin <= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2025-58014unauthenticated · needs a click≤ 6.7.0.64

    WordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability

    Medium 4.3

  • CVE-2024-1078subscriber+≤ 6.5.2.4

    Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory