Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

287 results · page 3 of 6

Nov 19, 2025Quiz Maker: Sensitive Information ExposureCVE-2025-12426 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question.
Product
Quiz Maker
Affected
up to 6.7.0.80
What to do
Affects up to 6.7.0.80. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
What to do
Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2025Watu Quiz: Stored Cross-Site ScriptingCVE-2025-11238 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an user accesses an injected page.
Product
Watu Quiz
What to do
Update Watu Quiz to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025qnotsquiz: Stored Cross-Site ScriptingCVE-2025-12016 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
qnotsquiz
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update qnotsquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 3, 2025Ultimate Viral Quiz: Cross-Site Request ForgeryCVE-2025-10302 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ultimate Viral Quiz
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ultimate Viral Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025Interact: Embed A Quiz On Your Site: Cross-Site Request Forgery (CSRF)CVE-2025-58675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through <= 3.1.
Product
Interact: Embed A Quiz On Your Site
Affected
up to 3.1
What to do
Affects up to 3.1. Update Interact: Embed A Quiz On Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Quiz Maker: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58015 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.
Product
Quiz Maker
Affected
up to 6.7.0.65
What to do
Affects up to 6.7.0.65. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Quiz Maker: Cross-Site Request Forgery (CSRF)CVE-2025-58014 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.64.
Product
Quiz Maker
Affected
up to 6.7.0.64
What to do
Affects up to 6.7.0.64. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2025Chained Quiz: Insecure Direct Object Reference in version 1CVE-2025-10493 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
Product
Chained Quiz
What to do
Update Chained Quiz to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2025Quiz Maker: SQL InjectionCVE-2025-10042 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled.
Product
Quiz Maker
Affected
up to 6.7.0.56
What to do
Affects up to 6.7.0.56. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 2, 2025Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: PHP Object InjectionCVE-2025-9260 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, remote code execution is possible. While the vendor patched this issue in version 6.1.0, the patch caused a fatal error in the vulnerable code, due to a missing class import, so we consider 6.1.2 to be the most complete and best patched version
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
5.1.16 to 6.1.1
What to do
Affects 5.1.16 to 6.1.1. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53328 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.11.0.
Product
Poll, Survey & Quiz Maker Plugin by Opinion Stage
Affected
up to 19.11.0
What to do
Affects up to 19.11.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-55708 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.2.4.
Product
Quiz And Survey Master
Affected
up to 10.2.4
What to do
Affects up to 10.2.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Quiz and Survey Master (QSM): Does not have CSRF check in placeCVE-2025-6790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Quiz and Survey Master (QSM)
Fixed in
10.2.3
What to do
Update Quiz and Survey Master (QSM) to 10.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2025MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Stored Cross-Site ScriptingCVE-2025-5684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 23, 2025Qwizcards | online quizzes and flashcards: Does not sanitise and escape the "_stylesheet" parameter before outputting it back in the pageCVE-2025-6174 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
Product
Qwizcards | online quizzes and flashcards
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Qwizcards | online quizzes and flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2025WPQuiz: SQL InjectionCVE-2025-6739 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPQuiz
Affected
up to 0.4.2
What to do
Affects up to 0.4.2. Update WPQuiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 20, 2025Fyrebox Quizzes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
Product
Fyrebox Quizzes
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Unauthorized modification of dataCVE-2025-3880 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
Product
Poll, Survey & Quiz Maker Plugin by Opinion Stage
Affected
up to 19.9.0
What to do
Affects up to 19.9.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Quiz Maker
Fixed in
6.5.9.9
What to do
Update Quiz Maker to 6.5.9.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025HD Quiz: Does not sanitise and escape some of its settingsCVE-2024-13383 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
HD Quiz
Fixed in
2.0.0
What to do
Update HD Quiz to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Contact Form, Survey, Quiz & Popup Form Builder: Does not sanitise and escape some parametersCVE-2024-10504 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Product
Contact Form, Survey, Quiz & Popup Form Builder
Fixed in
1.7.1
What to do
Update Contact Form, Survey, Quiz & Popup Form Builder to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2025WP Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Quiz wp-quiz allows Stored XSS.This issue affects WP Quiz: from n/a through <= 2.0.10.
Product
WP Quiz
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update WP Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025Watu Quiz: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46242 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.3.
Product
Watu Quiz
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025SS Quiz: Deserialization of Untrusted DataCVE-2025-27287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ssvadim SS Quiz ssquiz allows Object Injection.This issue affects SS Quiz: from n/a through <= 2.0.5.
Product
SS Quiz
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update SS Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: PHP Object InjectionCVE-2025-3439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 11, 2025The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary shortcode executionCVE-2025-3422 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Reflected Cross-Site ScriptingCVE-2025-3421 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Watu Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30844 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affects Watu Quiz: from n/a through <= 3.4.2.
Product
Watu Quiz
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025LeadQuizzes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yazamodeveloper LeadQuizzes leadquizzes allows Stored XSS.This issue affects LeadQuizzes: from n/a through <= 1.1.0.
Product
LeadQuizzes
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update LeadQuizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Quiz Maker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30774 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker quiz-maker allows SQL Injection.This issue affects Quiz Maker: from n/a through <= 6.6.8.7.
Product
Quiz Maker
Affected
up to 6.6.8.7
What to do
Affects up to 6.6.8.7. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Quiz Cat: Missing AuthorizationCVE-2025-30877 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz Cat: from n/a through <= 3.0.8.
Product
Quiz Cat
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Quiz Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quiz and Survey Master (QSM)
Fixed in
9.2.1
What to do
Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 22, 2025Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: IP Address SpoofingCVE-2024-13666 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Unauthenticated Post TrashingCVE-2025-2290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 8.0.1
What to do
Affects up to 8.0.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Stored Cross-Site ScriptingCVE-2024-13497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Quizzin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23494 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binnyva Quizzin quizzin allows Reflected XSS.This issue affects Quizzin: from n/a through <= 1.01.4.
Product
Quizzin
Affected
up to 1.01.4
What to do
Affects up to 1.01.4. Update Quizzin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025Quiz Organizer: Stored Cross-Site ScriptingCVE-2024-6810 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Quiz Organizer
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Quiz Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
Product
Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.0.9.4
What to do
Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 19, 2025Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily: Stored Cross-Site ScriptingCVE-2024-12522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2025Easy Quiz Maker: Stored Cross-Site ScriptingCVE-2024-13456 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Quiz Maker
Affected
up to 2.0
What to do
Affects up to 2.0. Update Easy Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 7, 2025Fyrebox Quizzes: Cross-Site Request Forgery (CSRF)CVE-2025-25125 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
Product
Fyrebox Quizzes
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 5, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Sensitive Information ExposureCVE-2024-13829 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.8
What to do
Affects up to 8.0.8. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025WordPress Survey & Poll – Quiz, Survey and Poll Plugin for: SQL InjectionCVE-2024-13596 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update WordPress Survey & Poll – Quiz, Survey and Poll Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Reflected Cross-Site ScriptingCVE-2024-10636 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Arbitrary shortcode executionCVE-2024-10633 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: SQL InjectionCVE-2024-10628 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: The three variations of this software (Business, Developer, and Agency) share the same plugin slug, so you may get an alert even if you are running the latest version of any of the pieces of software. In these cases it is safe to dismiss the notice once you've confirmed your site is on a patched version of the applicable software.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com ays-pro.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Unauthorized modification of dataCVE-2024-10574 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 24, 2025Chained Quiz: Server-Side Request Forgery (SSRF)CVE-2025-24701 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through <= 1.3.2.9.
Product
Chained Quiz
Affected
up to 1.3.2.9
What to do
Affects up to 1.3.2.9. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025University Quizzes Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.
Product
University Quizzes Online
Affected
up to 1.4
What to do
Affects up to 1.4. Update University Quizzes Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.