Onionbuzz Viral Quiz Vulnerabilities

The OnionBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrat...

CVSS:

4.3

Affected:

up to 1.0.7

Fix:

No patched version reported

Disclosed:

Jun 27, 2025

CVE-2025-53312 on NVD →

The Viral Quiz Maker - OnionBuzz plugin for WordPress is vulnerable to blind SQL Injection via the ‘ob_get_results' ajax nopriv handler in versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVSS:

10

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Jul 20, 2019

CVE-2019-14231 on NVD →

The OnionBuzz Plugin for WordPress is vulnerable to blind SQL Injection via the id parameter in versions up to, and including, 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append a...

CVSS:

9.8

Affected:

up to 1.2.7

Fixed in:

1.2.7

Disclosed:

Jul 20, 2019

CVE-2019-14230 on NVD →