{"id":"CVE-2026-110379","kind":"vulnerability","aliases":["CVE-2026-110379"],"related":[],"title":"Ays Pro Quiz Maker WordPress plugin: reflected XSS through version 6.7.1.91","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.","summary":"The Quiz Maker plugin by Ays Pro does not neutralize input before putting it into web pages, so a crafted link can inject script into a visitor's browser. An attacker could run script in the session of a user who opens the link, such as stealing a logged-in admin's session.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","quiz-maker","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Quiz Maker plugin version in the WordPress admin under Plugins; the sources say the issue affects versions up to and including `6.7.1.91`.\n- Confirm whether the site is running the plugin at all.","fix":"- Update Quiz Maker to a version later than `6.7.1.91`; the sources do not name the fixed release, so check the plugin's changelog.","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:36:06+00:00","updated_at":"2026-10-25T03:36:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update Quiz Maker to a version later than `6.7.1.91`; the sources do not name the fixed release, so check the plugin's changelog.","reach":"internet","title":"Ays Pro Quiz Maker WordPress plugin: reflected XSS through version 6.7.1.91","impact":"medium","summary":"The Quiz Maker plugin by Ays Pro does not neutralize input before putting it into web pages, so a crafted link can inject script into a visitor's browser. An attacker could run script in the session of a user who opens the link, such as stealing a logged-in admin's session.","category":"package","nicknames":[],"who_cares":["wordpress","quiz-maker","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in a victim's browser on the site.","analyst_note":"Confirm the fixed Quiz Maker version and the vulnerable parameter from the NVD entry or the plugin vendor changelog.","how_to_check":"- Check the installed Quiz Maker plugin version in the WordPress admin under Plugins; the sources say the issue affects versions up to and including `6.7.1.91`.\n- Confirm whether the site is running the plugin at all.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ays Pro Quiz Maker plugin at or below version 6.7.1.91 are exposed, since the flaw sits in the plugin's page output. The sources do not say which configurations or roles are required, so treat any site with the plugin installed as in scope. Sites without the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":3320,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110379':14A,17A '-2026':13A,16A '6.7.1.91':11A,111C 'admin':77B 'affect':105C 'allow':101C 'attack':56B 'ay':1A,31B,94C 'browser':54B 'could':57B 'craft':45B 'cross':89C 'cross-sit':88C 'cve':12A,15A 'generat':87C 'host':24B 'improp':80C 'inject':48B 'input':36B,83C 'issu':104C 'link':46B,69B 'log':75B 'logged-in':74B 'maker':4A,21B,28B,97C,100C,107C 'n/a':109C 'neutral':35B,81C 'open':67B 'packag':18B 'page':42B,86C 'plugin':6A,29B 'pro':2A,32B,95C 'put':38B 'quiz':3A,20B,27B,96C,99C,106C 'quiz-mak':19B,98C 'reflect':7A,102C 'run':58B 'script':49B,59B,91C 'self':23B 'self-host':22B 'session':62B,79B 'site':90C 'steal':72B 'user':65B 'version':10A 'visitor':52B 'vulner':92C 'web':41B,85C 'wordpress':5A,25B 'xss':8A 'xss.this':103C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ays Pro Quiz Maker plugin at or below version 6.7.1.91 are exposed, since the flaw sits in the plugin's page output. The sources do not say which configurations or roles are required, so treat any site with the plugin installed as in scope. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110379","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}