Cross-Site Scripting
7 records28%First: 2023. Latest: 2026.
Plugin security history
Quiz Maker by AYS Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 25 vulnerability records associated with Quiz Maker by AYS, published between 2021 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
25Total records
1Critical
5High
19Medium
0Low
0Informational
25Patched records
0Currently marked unpatched
2021-06-29First disclosure
2026-05-01Latest disclosure
25 of 25CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2021 | 1 | |
| 2023 | 4 | |
| 2024 | 6 | |
| 2025 | 11 | |
| 2026 | 3 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 4% |
| High | 5 | 20% |
| Medium | 19 | 76% |
Vulnerability-Type Breakdown
SQL Injection
5 records20%First: 2021. Latest: 2025.
Missing Authorization
5 records20%First: 2023. Latest: 2025.
Other
3 records12%First: 2023. Latest: 2025.
CSRF
3 records12%First: 2025. Latest: 2026.
Information Disclosure
2 records8%First: 2025. Latest: 2025.
Patch Status
- Patched
- 25
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
6.7.1.306.7.1.86.7.1.36.7.0.896.7.0.836.7.0.816.7.0.666.7.0.656.7.0.576.6.8.831.8.0.1008.8.0.10021.8.0.1006.5.9.96.5.8.46.5.2.56.5.0.66.5.1.26.4.9.56.4.2.76.3.9.56.2.0.9
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-6.5.2.4 | Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval | February 6, 2024 | 6.5.2.5 | Medium |
*-6.5.0.5 | Quiz Maker <= 6.5.0.5 - Denial of Service | January 12, 2024 | 6.5.0.6 | Medium |
*-6.5.1.1 | Quiz Maker <= 6.5.1.1 - Missing Authorization | January 5, 2024 | 6.5.1.2 | Medium |
*-6.4.9.4 | Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure | November 30, 2023 | 6.4.9.5 | Medium |
*-6.4.9.4 | Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting | November 30, 2023 | 6.4.9.5 | Medium |
*-6.4.2.6 | Quiz Maker <= 6.4.2.6 - Reflected Cross-Site Scripting | May 15, 2023 | 6.4.2.7 | Medium |
*-6.3.9.4 | Quiz Maker <= 6.3.9.4 - Content Spoofing | January 20, 2023 | 6.3.9.5 | Medium |
[*, 6.2.0.9) | Quiz Maker <= 6.2.0.8 - SQL Injection | June 29, 2021 | 6.2.0.9 | High |
Selected source records
Latest Records
MediumCVE-2026-6817
Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
Published: May 1, 2026
- Affected versions
- *-6.7.1.29
- Patched versions
- 6.7.1.30
MediumCVE-2026-2384
Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: February 19, 2026
- Affected versions
- *-6.7.1.7
- Patched versions
- 6.7.1.8
MediumCVE-2026-32342
Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery
Published: February 10, 2026
- Affected versions
- *-6.7.1.2
- Patched versions
- 6.7.1.3
MediumCVE-2025-14579
Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting
Published: December 22, 2025
- Affected versions
- *-6.7.0.88
- Patched versions
- 6.7.0.89
MediumCVE-2025-67595
Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
Published: December 2, 2025
- Affected versions
- *-6.7.0.82
- Patched versions
- 6.7.0.83
MediumCVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
Published: November 18, 2025
- Affected versions
- *-6.7.0.80
- Patched versions
- 6.7.0.81
MediumCVE-2025-58014
Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery
Published: September 22, 2025
- Affected versions
- *-6.7.0.64
- Patched versions
- 6.7.0.65
MediumCVE-2025-58015
Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure
Published: September 22, 2025
- Affected versions
- *-6.7.0.65
- Patched versions
- 6.7.0.66
Highest-Severity Records
CriticalCVE-2024-6028
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
Published: June 24, 2024
- Affected versions
- *-6.5.8.3
- Patched versions
- 6.5.8.4
HighCVE-2024-10628
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id
Published: January 25, 2025
- Affected versions
- 20.0.0-21.8.0
- Patched versions
- 21.8.0.100
- Affected versions
- 7.0.0-8.8.0
- Patched versions
- 8.8.0.100
- Affected versions
- 30.0.0-31.8.0
- Patched versions
- 31.8.0.100
HighCVE-2025-30774
Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection
Published: March 29, 2025
- Affected versions
- *-6.6.8.7
- Patched versions
- 6.6.8.8
HighCVE-2024-10633
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content
Published: January 25, 2025
- Affected versions
- 20.0.0-21.8.0
- Patched versions
- 21.8.0.100
- Affected versions
- 7.0.0-8.8.0
- Patched versions
- 8.8.0.100
- Affected versions
- 30.0.0-31.8.0
- Patched versions
- 31.8.0.100
HighCVE-2021-24456
Quiz Maker <= 6.2.0.8 - SQL Injection
Published: June 29, 2021
- Affected versions
- [*, 6.2.0.9)
- Patched versions
- 6.2.0.9
HighCVE-2024-10574
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting
Published: January 25, 2025
- Affected versions
- 20.0.0-21.8.0
- Patched versions
- 21.8.0.100
- Affected versions
- 7.0.0-8.8.0
- Patched versions
- 8.8.0.100
- Affected versions
- 30.0.0-31.8.0
- Patched versions
- 31.8.0.100
MediumCVE-2026-2384
Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: February 19, 2026
- Affected versions
- *-6.7.1.7
- Patched versions
- 6.7.1.8
MediumCVE-2023-6166
Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting
Published: November 30, 2023
- Affected versions
- *-6.4.9.4
- Patched versions
- 6.4.9.5
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.