The vulnerability arises from the WordPress Quiz Maker plugin’s failure to properly neutralize user‑supplied input during page generation, allowing reflected cross‑site scripting. When an attacker supplies malicious JavaScript that is echoed back in a quiz page, the script is executed in the browsers of any user who visits that page, enabling arbitrary client‑side code execution.

Affected is the Ays Pro Quiz Maker plugin for WordPress, with all releases from the earliest available version through 6.7.1.91 vulnerable. The issue is fixed in version 6.7.1.92 and later; sites running an earlier version are at risk unless the plugin is disabled or upgraded.

The CVSS score of 7.1 categorizes this flaw as high severity. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, but the absence of those metrics does not reduce the potential danger. Based on the description, it is inferred that the attack vector involves a crafted URL containing malicious input that is reflected unescaped; exploitation requires a victim to visit the crafted page, a typical scenario for reflected XSS.