Skip to main content

Quiz Maker CVE-2024-22027

MEDIUM
Improper Input Validation (CWE-20)
2024-01-12 vultures@jpcert.or.jp
WordPress Denial Of Service Quiz Maker Wordpress Plugin Ays Pro
6.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Impact

CVSS score of 6.5 (MEDIUM). Attack characteristics: network attack vector, low complexity, low privileges required, no user interaction not required. EPSS exploitation probability: 0.51%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-20. Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services. Affected products include: Ays-Pro Quiz Maker. Version information: prior to 6.5.0.6.

Know when Quiz Maker gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.

Executive ViewAI

Why It Matters

Organizations using WordPress Quiz Maker Plugin should be aware of notable risk from CVE-2024-22027, a input validation vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.

Threat Intelligence Overview

EPSS Score
0.5%
Top 34% exploitable

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No

Priority Score

33
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*

More in Quiz Maker

View all
CVE-2024-6028 CRITICAL POC
9.8 Jun 25

The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all v
CVE-2025-10042 HIGH POC
7.5 Sep 17

SQL injection in the Quiz Maker WordPress plugin through 6.7.0.56 allows unauthenticated attackers to read sensitive dat
CVE-2023-6166 MEDIUM POC
6.1 Dec 26

The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, lead
CVE-2023-2571 MEDIUM POC
6.1 Jun 05

The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes
CVE-2023-6155 MEDIUM POC
5.3 Dec 26

The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX acti
CVE-2025-30774 HIGH
8.2 Apr 01

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker
CVE-2025-12426 HIGH
7.5 Nov 19

Quiz Maker WordPress plugin through 6.7.0.80 exposes quiz answer data to unauthenticated remote users because the ays_qu
CVE-2021-24456 HIGH
7.2 Aug 02

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters bef
CVE-2026-110379 HIGH
7.1 Oct 19

Reflected cross-site scripting in the Ays Pro Quiz Maker WordPress plugin through version 6.7.1.91 lets unauthenticated

CVE-2024-1079 MEDIUM
5.3 Feb 07

The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th
CVE-2025-58015 MEDIUM
5.3 Sep 22

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker allows Re
CVE-2024-1078 MEDIUM
4.3 Feb 07

The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
REF https://jvn.jp/en/jp/JVN37326856/ REF https://wordpress.org/plugins/quiz-maker/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy