WordPress quiz-maker has 12 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-6028 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and i | critical | 9.8 | <6.5.8.4 | 6.5.8.4 |
| CVE-2023-2571 | The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflect | medium | 6.1 | <6.4.2.7 | 6.4.2.7 |
| CVE-2021-24456 | The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQ | high | 7.2 | <6.2.0.9 | 6.2.0.9 |
| CVE-2025-10042 | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due | medium | 5.9 | <6.7.0.57 | 6.7.0.57 |
| CVE-2024-10628 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions u | high | 7.5 | >=7.0.0 and <8.8.0.100 or >=20.0.0 and <21.8.0.100 or >=30.0.0 and <31.8.0.100 | 8.8.0.100, 21.8.0.100, 31.8.0.100 |
| CVE-2024-22027 | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a | medium | 6.5 | <6.5.0.6 | 6.5.0.6 |
| CVE-2023-6155 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unau | medium | 5.3 | <6.4.9.5 | 6.4.9.5 |
| CVE-2024-1079 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() | medium | 5.3 | <6.5.2.5 | 6.5.2.5 |
| CVE-2023-6166 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cro | medium | 6.1 | <6.4.9.5 | 6.4.9.5 |
| CVE-2024-1078 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_st | medium | 4.3 | <6.5.2.5 | 6.5.2.5 |
| CVE-2025-12426 | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is | medium | 5.3 | <6.7.0.81 | 6.7.0.81 |
| CVE-2024-8617 | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users suc | medium | 4.8 | <6.5.9.9 | 6.5.9.9 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked