CVE-2024-13383

The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13383 HD Quiz < 2.0.0 - Editor+ Stored XSS

The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13383

The CVE-2024-13383 entry concerns the WordPress HD Quiz plugin (pre-2.0.0). The root cause is lack of proper sanitisation/escaping of certain plugin settings, which can allow Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e...

PT-2025-21455 · WordPress · Hd Quiz

Name of the Vulnerable Software and Affected Versions: HD Quiz WordPress plugin version prior to 2.0.0 Description: The issue concerns the HD Quiz WordPress plugin, where versions prior to 2.0.0 do not properly sanitise and escape some of its settings. This could allow high privilege users, such ...

CVE-2025-27287

CVE-2025-27287 concerns a Deserialization of Untrusted Data vulnerability in the WordPress plugin SS Quiz (ssquiz) that enables PHP object injection. Affected versions are from n/a through 2.0.5. The issue stems from untrusted data deserialization, enabling unintended object instantiation. Severa...

WordPress SS Quiz Plugin <= 2.0.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin SS Quiz versions = 2.0.5...

CVE-2024-11323

The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the aiquizupdatestyle function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers,...

CVE-2025-24701 WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through = 1.3.2.9...

CVE-2025-24701 WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Kiboko Labs Chained Quiz allows Server Side Request Forgery. This issue affects Chained Quiz: from n/a through 1.3.2.9...

CVE-2024-11323

The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the aiquizupdatestyle function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers,...

CVE-2024-11323 AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the aiquizupdatestyle function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers,...

WordPress AI Quiz plugin <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by vgo0 in WordPress Plugin AI Quiz versions = 1.1...

WordPress AI Quiz plugin <= 1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin AI Quiz versions = 1.1...

WordPress AI Quiz Plugin <= 1.1 is vulnerable to Broken Access Control

Software AI Quiz Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-53708 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6ee310016b7b Credits Mika Required privilege Unauthenticated...

WordPress Watu Quiz plugin < 3.4.1.2 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Eunho Kim in WordPress Plugin Watu Quiz versions 3.4.1.2...

PT-2024-21374 · WordPress · Watu Quiz

Name of the Vulnerable Software and Affected Versions: Watu Quiz WordPress plugin versions prior to 3.4.1.2 Description: The issue allows users, such as authors authorized by admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the...

WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin Chained Quiz versions = 1.3.2.8...

WordPress Chained Quiz Plugin <= 1.3.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Chained Quiz Type Plugin Vulnerable versions = 1.3.2.8 Fixed in 1.3.2.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37446 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 534f1e281848 Credits Manab Jyoti Dowarah Required privileg...

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress < 9.0.2 - Authenticated (Contributor+) SQL Injection

Description The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'questionid' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2024-0872

The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user meta data which ca...