PT-2023-20263 · WordPress · Quiz Maker

Name of the Vulnerable Software and Affected Versions: The Quiz Maker WordPress plugin versions prior to 6.4.2.7 Description: The issue is related to Reflected Cross-Site Scripting, which occurs because some parameters are not properly escaped before being outputted back in attributes. This could...

Quiz Maker < 6.4.2.7 - Reflected XSS

The plugin does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open the URL below other URL are also affected...

WordPress Easy Quiz Maker Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Quiz Maker Type Plugin Vulnerable versions = 1.5 Fixed in 2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 43ad93965d09 Credits Unknown Required privilege...

WordPress Quiz Maker Plugin <= 6.3.9.4 is vulnerable to Content Spoofing

Software Quiz Maker Type Plugin Vulnerable versions = 6.3.9.4 Fixed in 6.3.9.5 OWASP Top 10 A1: Injection Classification Content Spoofing CVE CVE-2023-23985 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 06c670b37093 Credits yuyudhn Required privilege Unauthenticated...

WordPress Quiz Maker plugin SQL Injection Vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...

CVE-2021-24456

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

Sql injection

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456

CVE-2021-24456 affects WordPress Quiz Maker plugin up to version 6.2.0.9. The vulnerability stems from insufficient sanitization/escaping of the order and orderby parameters used in SQL statements, enabling SQL injection in the admin dashboard. Confirmed sources (Red Hat, CVE/NVD/CVEList, CNVD, W...

CVE-2021-24456 Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

PT-2021-15982

Name of the Vulnerable Software and Affected Versions The Quiz Maker versions prior to 6.2.0.9 Description The issue arises from improper sanitization and escaping of the order and orderby parameters before their use in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456: Improper Neutralization of Special Elements used in an SQL Command

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

WordPress SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...

WordPress Quiz Maker plugin <= 6.2.0.8 - Multiple Authenticated Blind SQL Injection (SQLi) vulnerabilities

Multiple Authenticated Blind SQL Injection SQLi vulnerabilities discovered by To Quang Duong in the WordPress Quiz Maker plugin versions = 6.2.0.8. Solution Update the WordPress Quiz Maker plugin to the latest available version at least 6.2.0.9...

Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

The plugin did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard When we WPScanTeam confirmed the issues, more SQL Injections were identified, reported and fixed by the vendor but have not...

WordPress Viral Quiz Maker - OnionBuzz plugin SQL injection vulnerability (CNVD-2019-27322)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Viral Quiz Maker - OnionBuzz plugin is one of the quiz plugins used in it. A SQL injection vulnerability exists in WordPress Viral Quiz...

CVE-2019-14231

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the obgetresults ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an...

CVE-2019-14230

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the setcount ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged use...

CVE-2019-14230

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the setcount ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged use...

CVE-2019-14231

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the obgetresults ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an...