{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/quiz-maker--6.7.1.91/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110379"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Quiz Maker (\u003c= 6.7.1.91)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","xss","wordpress"],"_cs_type":"advisory","_cs_vendors":["Ays Pro"],"content_html":"\u003cp\u003eThe Quiz Maker plugin (up to version 6.7.1.91) for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-110379. This flaw exists due to improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can exploit this vulnerability by enticing a privileged user to interact with a crafted malicious URL. When the victim accesses this URL, the plugin improperly reflects the attacker-supplied input within the page context, causing the victim's browser to execute injected scripts. This could lead to session hijacking, unauthorized administrative actions, or defacement of the affected WordPress site. Defenders should note that this is a client-side injection vulnerability targeting the end-user session rather than the server-side filesystem or database.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the victim's session. If a site administrator is targeted, the attacker could perform administrative actions, create new accounts, or exfiltrate sensitive configuration data. Given the ubiquity of WordPress installations, this vulnerability presents a significant risk to organizations using the Quiz Maker plugin for customer engagement or lead generation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for security operations and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Quiz Maker plugin to version 6.7.1.92 or higher to resolve the input sanitization flaw.\u003c/li\u003e\n\u003cli\u003eAudit WordPress access logs for anomalous GET requests containing suspicious URL parameters (e.g., payloads involving script tags or event handlers) directed at the plugin-specific endpoints.\u003c/li\u003e\n\u003cli\u003eImplement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting where scripts can be loaded and executed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T12:03:09Z","date_published":"2026-10-19T12:03:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110379/","summary":"The Quiz Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input sanitization, potentially allowing attackers to execute arbitrary scripts in a user’s browser.","title":"Reflected Cross-Site Scripting Vulnerability in Quiz Maker Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110379/"}],"language":"en","title":"CraftedSignal Threat Feed - Quiz Maker (\u003c= 6.7.1.91)","version":"https://jsonfeed.org/version/1.1"}