Reflected Cross-Site Scripting Vulnerability in Quiz Maker Plugin

The Quiz Maker plugin (up to version 6.7.1.91) for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-110379. This flaw exists due to improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can exploit this vulnerability by enticing a privileged user to interact with a crafted malicious URL. When the victim accesses this URL, the plugin improperly reflects the attacker-supplied input within the page context, causing the victim's browser to execute injected scripts. This could lead to session hijacking, unauthorized administrative actions, or defacement of the affected WordPress site. Defenders should note that this is a client-side injection vulnerability targeting the end-user session rather than the server-side filesystem or database.

Impact

Successful exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the victim's session. If a site administrator is targeted, the attacker could perform administrative actions, create new accounts, or exfiltrate sensitive configuration data. Given the ubiquity of WordPress installations, this vulnerability presents a significant risk to organizations using the Quiz Maker plugin for customer engagement or lead generation.

Recommendation

Prioritized, concrete actions for security operations and IT teams:

• Immediately update the Quiz Maker plugin to version 6.7.1.92 or higher to resolve the input sanitization flaw.
• Audit WordPress access logs for anomalous GET requests containing suspicious URL parameters (e.g., payloads involving script tags or event handlers) directed at the plugin-specific endpoints.
• Implement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting where scripts can be loaded and executed.