Quiz Maker EUVD-2026-104132

Exploitation requires an unauthenticated attacker to deliver a crafted request/URL to a user whose browser then renders the reflected payload (UI:R) - meaning successful attack depends on social engineering such as phishing or a malicious link, not on a passive background process. The impact is highest when the lured victim is an authenticated administrator, since the injected script runs in the WordPress site origin. There are no stated special configuration prerequisites in the description; the flaw affects Quiz Maker versions from n/a through 6.7.1.91. The primary limiting factors are the mandatory victim interaction and the transient, per-request nature of reflected (non-persistent) XSS.

This is a reflected cross-site scripting flaw (CWE-79) in the Ays Pro Quiz Maker WordPress plugin, scored CVSS 7.1 by Patchstack (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity, unauthenticated exploitation but requires user interaction (UI:R) - the victim must be lured into clicking or loading a crafted request, which is the dominant limiting factor for any reflected XSS. No EPSS score, CISA KEV listing, POC, or SSVC data was provided, so there is no evidence of active exploitation or published exploit code; status is 'no public exploit identified at time of analysis.' The 7.1 score is elevated primarily by the scope change (S:C) and the combined low C/I/A impacts; in practice reflected XSS risk is moderate and victim-dependent rather than a wormable, server-side compromise. Note the input assigns A:L (availability impact) which is atypical for reflected XSS - this is likely a conservative automated scoring choice and should be verified, as most reflected XSS has no genuine availability impact. Overall this is a real but moderate-priority issue: unauthenticated and network-facing, but gated behind social-engineering (UI:R) and lacking any exploitation signal.

An attacker crafts a malicious URL targeting a vulnerable Quiz Maker parameter that reflects unsanitized input into the page, then phishes or lures a logged-in site administrator or visitor into clicking it. When the victim's browser renders the response, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft, admin action forgery, or content manipulation. No public exploit code was identified, but reflected XSS of this type is straightforward to weaponize given the low attack complexity (AC:L).