Wp Quiz Vulnerabilities

The WP Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

Affected:

up to 2.0.10

Fix:

No patched version reported

Disclosed:

Apr 25, 2025

CVE-2025-46482 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Quiz allows Stored XSS.This issue affects WP Quiz: from n/a through 2.0.10.

Affected:

up to 2.0.10

Fix:

No patched version reported

Disclosed:

Apr 25, 2025

CVE-2025-46482 on NVD →

Settings fields allows to add XSS. Related file: class-page-config.php. The user should have An author or Editor role. Add XSS payload to Quiz e.g. <script>alert(document.cookie)<script> Update the plugin to v1.0.8.

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

May 22, 2017