Live › vulnerability › CVE-2026-110379
Go to dashboardThe Quiz Maker plugin by Ays Pro does not neutralize input before putting it into web pages, so a crafted link can inject script into a visitor's browser. An attacker could run script in the session of a user who opens the link, such as stealing a logged-in admin's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ays Pro Quiz Maker plugin at or below version 6.7.1.91 are exposed, since the flaw sits in the plugin's page output. The sources do not say which configurations or roles are required, so treat any site with the plugin installed as in scope. Sites without the plugin can skip it.
No product ranges from the sources yet.
6.7.1.91.6.7.1.91; the sources do not name the fixed release, so check the plugin's changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
This page as .md · .json · in your agent: get_signal("CVE-2026-110379")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.