Plugin security history

Quiz Maker by AYS Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 25 vulnerability records associated with Quiz Maker by AYS, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

25Total records

1Critical

5High

19Medium

0Low

0Informational

25Patched records

0Currently marked unpatched

2021-06-29First disclosure

2026-05-01Latest disclosure

25 of 25CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2023	4	4 records
2024	6	6 records
2025	11	11 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	1	4%
High	5	20%
Medium	19	76%

Vulnerability-Type Breakdown

Cross-Site Scripting

7 records28%

First: 2023. Latest: 2026.

SQL Injection

5 records20%

First: 2021. Latest: 2025.

Missing Authorization

5 records20%

First: 2023. Latest: 2025.

Other

3 records12%

First: 2023. Latest: 2025.

CSRF

3 records12%

First: 2025. Latest: 2026.

Information Disclosure

2 records8%

First: 2025. Latest: 2025.

Patch Status

Patched: 25
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.7.1.30
6.7.1.8
6.7.1.3
6.7.0.89
6.7.0.83
6.7.0.81
6.7.0.66
6.7.0.65
6.7.0.57
6.6.8.8
31.8.0.100
8.8.0.100
21.8.0.100
6.5.9.9
6.5.8.4
6.5.2.5
6.5.0.6
6.5.1.2
6.4.9.5
6.4.2.7
6.3.9.5
6.2.0.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.7.1.29`	Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'	May 1, 2026	6.7.1.30	Medium
`*-6.7.1.7`	Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	February 19, 2026	6.7.1.8	Medium
`*-6.7.1.2`	Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery	February 10, 2026	6.7.1.3	Medium
`*-6.7.0.88`	Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting	December 22, 2025	6.7.0.89	Medium
`*-6.7.0.82`	Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery	December 2, 2025	6.7.0.83	Medium
`*-6.7.0.80`	Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure	November 18, 2025	6.7.0.81	Medium
`*-6.7.0.65`	Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure	September 22, 2025	6.7.0.66	Medium
`*-6.7.0.64`	Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery	September 22, 2025	6.7.0.65	Medium
`*-6.7.0.56`	Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection	September 16, 2025	6.7.0.57	Medium
`*-6.6.8.7`	Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection	March 29, 2025	6.6.8.8	High
`30.0.0-31.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content	January 25, 2025	31.8.0.100	High
`7.0.0-8.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content	January 25, 2025	8.8.0.100	High
`20.0.0-21.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content	January 25, 2025	21.8.0.100	High
`30.0.0-31.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting	January 25, 2025	31.8.0.100	High
`7.0.0-8.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting	January 25, 2025	8.8.0.100	High
`20.0.0-21.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting	January 25, 2025	21.8.0.100	High
`30.0.0-31.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id	January 25, 2025	31.8.0.100	High
`7.0.0-8.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id	January 25, 2025	8.8.0.100	High
`20.0.0-21.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id	January 25, 2025	21.8.0.100	High
`30.0.0-31.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content	January 25, 2025	31.8.0.100	Medium
`7.0.0-8.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content	January 25, 2025	8.8.0.100	Medium
`20.0.0-21.8.0`	Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content	January 25, 2025	21.8.0.100	Medium
`*-6.5.9.8`	Quiz Maker <= 6.5.9.8 - Authenticated (Admin+) Stored Cross-Site Scripting	September 16, 2024	6.5.9.9	Medium
`*-6.5.8.3`	Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter	June 24, 2024	6.5.8.4	Critical
`*-6.5.2.4`	Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification	February 6, 2024	6.5.2.5	Medium

Selected source records

Latest Records

MediumCVE-2026-6817

Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'

Published: May 1, 2026

Affected versions: *-6.7.1.29
Patched versions: 6.7.1.30

Original Wordfence record

MediumCVE-2026-2384

Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: February 19, 2026

Affected versions: *-6.7.1.7
Patched versions: 6.7.1.8

Original Wordfence record

MediumCVE-2026-32342

Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery

Published: February 10, 2026

Affected versions: *-6.7.1.2
Patched versions: 6.7.1.3

Original Wordfence record

MediumCVE-2025-14579

Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: December 22, 2025

Affected versions: *-6.7.0.88
Patched versions: 6.7.0.89

Original Wordfence record

MediumCVE-2025-67595

Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery

Published: December 2, 2025

Affected versions: *-6.7.0.82
Patched versions: 6.7.0.83

Original Wordfence record

MediumCVE-2025-12426

Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure

Published: November 18, 2025

Affected versions: *-6.7.0.80
Patched versions: 6.7.0.81

Original Wordfence record

MediumCVE-2025-58014

Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery

Published: September 22, 2025

Affected versions: *-6.7.0.64
Patched versions: 6.7.0.65

Original Wordfence record

MediumCVE-2025-58015

Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure

Published: September 22, 2025

Affected versions: *-6.7.0.65
Patched versions: 6.7.0.66

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-6028

Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

Published: June 24, 2024

Affected versions: *-6.5.8.3
Patched versions: 6.5.8.4

Original Wordfence record

HighCVE-2024-10628

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id

Published: January 25, 2025

Affected versions: 20.0.0-21.8.0
Patched versions: 21.8.0.100

Affected versions: 7.0.0-8.8.0
Patched versions: 8.8.0.100

Affected versions: 30.0.0-31.8.0
Patched versions: 31.8.0.100

Original Wordfence record

HighCVE-2025-30774

Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection

Published: March 29, 2025

Affected versions: *-6.6.8.7
Patched versions: 6.6.8.8

Original Wordfence record

HighCVE-2024-10633

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content

Published: January 25, 2025

Affected versions: 20.0.0-21.8.0
Patched versions: 21.8.0.100

Affected versions: 7.0.0-8.8.0
Patched versions: 8.8.0.100

Affected versions: 30.0.0-31.8.0
Patched versions: 31.8.0.100

Original Wordfence record

HighCVE-2021-24456

Quiz Maker <= 6.2.0.8 - SQL Injection

Published: June 29, 2021

Affected versions: [*, 6.2.0.9)
Patched versions: 6.2.0.9

Original Wordfence record

HighCVE-2024-10574

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting

Published: January 25, 2025

Affected versions: 20.0.0-21.8.0
Patched versions: 21.8.0.100

Affected versions: 7.0.0-8.8.0
Patched versions: 8.8.0.100

Affected versions: 30.0.0-31.8.0
Patched versions: 31.8.0.100

Original Wordfence record

MediumCVE-2026-2384

Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: February 19, 2026

Affected versions: *-6.7.1.7
Patched versions: 6.7.1.8

Original Wordfence record

MediumCVE-2023-6166

Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting

Published: November 30, 2023

Affected versions: *-6.4.9.4
Patched versions: 6.4.9.5

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory