WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injection
medium
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
- CVSS:
- 6.5
- Affected:
- up to 0.4.2
- Fix:
- No patched version reported
- Disclosed:
- Jul 3, 2025
CVE-2025-6739 on NVD →
WPQuiz [wpquiz] <= 2.7 (closed)
unknown
[en] Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewimage.php and (2) comments.php.
- Affected:
- up to 2.7
- Fixed in:
- 2.7
- Disclosed:
- Nov 30, 2007
CVE-2007-6172 on NVD →
WPQuiz [wpquiz] <= 0.4.2 (unfixed + closed)
unknown
- Affected:
- up to 0.4.2
- Fix:
- No patched version reported
CVE-2025-6739 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database