What is the CVSS score of CVE-2026-6817?

CVE-2026-6817 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Quiz Maker by AYS CVE-2026-6817

EUVD-2026-26786 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 12:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:00 euvd

EUVD-2026-26786

Analysis Generated

May 02, 2026 - 12:00 vuln.today

CVE Published

May 02, 2026 - 11:16 nvd

MEDIUM 5.8

DescriptionCVE.org

The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6.7.1.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in Quiz Maker by AYS WordPress plugin versions up to 6.7.1.29 allows unauthenticated attackers to inject arbitrary JavaScript through the 'rate_reason' parameter due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling credential theft, malware distribution, or defacement without requiring authentication or user interaction.

Technical ContextAI

Quiz Maker by AYS is a WordPress plugin (CPE: cpe:2.3:a:ays-pro:quiz_maker_by_ays) that provides quiz functionality to WordPress sites. The vulnerability exists in the handling of the 'rate_reason' parameter, which accepts user-supplied input that is stored in the database without proper sanitization and later rendered in page output without adequate HTML entity encoding or context-aware escaping. This is a classic Stored XSS vulnerability (CWE-79) where attacker-controlled data persists in the application database and is reflected to other users, making it more severe than Reflected XSS. The plugin fails to apply WordPress security functions such as sanitize_text_field() during input processing and wp_kses_post() or esc_html() during output rendering.

RemediationAI

Update Quiz Maker by AYS to version 6.7.1.30 or later, which patches the vulnerability by implementing proper input sanitization using WordPress sanitization functions and output escaping via wp_kses_post() or context-appropriate escaping. The patched version is confirmed in the WordPress plugin repository changeset referenced (https://plugins.trac.wordpress.org/changeset/3513370/quiz-maker). WordPress administrators should navigate to Plugins > Installed Plugins, locate 'Quiz Maker by AYS', and click 'Update Now' to apply the patch immediately. If immediate patching is not possible, disable the quiz functionality or restrict access to the quiz plugin via .htaccess, WordPress user role restrictions, or plugin disablement until the patch can be applied. Be aware that disabling the plugin will render quiz features unavailable to end users and should be treated as a temporary measure only. Review any stored quiz submissions or ratings created before patching for evidence of XSS payload injection.