CVE-2023-6155

The Red Hat, NVD, CVE and vendor records confirm CVE-2023-6155 affects the Quiz Maker WordPress plugin up to version 6.4.9.5, where the AJAX action ay s_quiz_author_user_search is not properly authorized. This allows an unauthenticated attacker to search system users and leaking their email addre...

CVE-2023-6166

The CVE-2023-6166 entry corresponds to the Quiz Maker WordPress plugin prior to version 6.4.9.5, which does not escape generated URLs in attributes, enabling Reflected Cross-Site Scripting. Affected component: Quiz Maker WordPress plugin (pre-6.4.9.5). Root cause: lack of URL escaping in output a...

CVE-2023-6166 Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting

The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

WordPress plugin Quiz Maker security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Poll Maker Plugin <= 4.8.0 is vulnerable to Broken Access Control

Software Poll Maker Type Plugin Vulnerable versions = 4.8.0 Fixed in 4.8.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50904 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID acddbd8f12ba Credits Abdi Pranata Required...

PT-2023-32547 · WordPress · Quiz Maker

Name of the Vulnerable Software and Affected Versions: The Quiz Maker WordPress plugin versions prior to 6.4.9.5 Description: The issue allows an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses, due to inadequate authorization of the a...

WordPress plugin Quiz Maker security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-32552 · WordPress · Quiz Maker

Name of the Vulnerable Software and Affected Versions: The Quiz Maker WordPress plugin versions prior to 6.4.9.5 Description: The issue is related to Reflected Cross-Site Scripting, where generated URLs are not properly escaped before being outputted in attributes. This can lead to malicious...

CVE-2022-47597

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1...

CVE-2022-47597

The CVE-2022-47597 entry affects the WordPress plugin Popup Maker (Popup for opt-ins, lead gen, & more) up to version 1.17.1. Multiple sources confirm an information disclosure vulnerability where sensitive data could be exposed to unauthenticated actors. NVD scores it CVSS v3.1 at 7.5 (High) wit...

CVE-2022-47597 WordPress Popup Maker Plugin <= 1.17.1 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1...

PT-2023-15420 · Unknown · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker – Popup for opt-ins, lead gen, & more versions 1.17.1 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This can potentially lead to unauthorized access to confidentia...

Playbook: Your First 100 Days as a vCISO - 5 Steps to Success

In an increasingly digital world, no organization is spared from cyber threats. Yet, not every organization has the luxury of hiring a full-time, in-house CISO. This gap in cybersecurity leadership is where you, as a vCISO, come in. You are the person who will establish, develop, and solidify the...

Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure

Description The plugin does not adequately authorize the aysquizauthorusersearch AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses. import string import requests baseurl =...

VulnCheck KEV: CVE-2022-0747

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...

Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting

Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting Visit the following URL: https://example.com/wp-admin/admin.php?page=quiz-maker-questions&fake%22%3E%3Cscript%3Ealert/xss/%3C/script%3E=something...

Form Maker < 1.15.21 - Captcha Bypass

Description The Form Maker plugin for WordPress is vulnerable to Captcha Bypass in versions up to, and including, 1.15.20 due to insufficient input verification. This makes it possible for unauthenticated attackers to automate form submissions...

Poll Maker < 4.7.2 - Missing Authorization

Description The Poll Maker plugin for WordPress is vulnerable to unauthorized access of data or functionality due to a missing capability check on one of its functions in all versions up to, and including, 4.7.1. This makes it possible for unauthenticated attackers to make use of this function...

WordPress Form Maker by 10Web Plugin <= 1.15.20 is vulnerable to Bypass Vulnerability

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.20 Fixed in 1.15.21 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48290 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 419f98d34635 Credits qilin99 Required...