The Quiz Maker plugin contains a stored cross‑site scripting flaw in its vc_quizmaker shortcode for all releases up to and including 6.7.1.7. Insufficient sanitization of user supplied attributes lets an authenticated user with contributor privileges inject arbitrary client‑side scripts into pages that use the shortcode. The injected scripts run in the browser context of any visitor to the affected page, creating risks for session hijacking, information theft, defacement, and further exploitation of the site. The weakness is classed as CWE‑79.

WordPress sites that use the Quiz Maker plugin version 6.7.1.7 or earlier, and have WPBakery Page Builder installed and active, are affected. The vendor is ays‑pro and any site owner using this plugin should verify their current version and upgrade if necessary.

With a CVSS score of 6.4, the issue is considered medium severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Nevertheless, attack requires authenticated contributor or higher access and the presence of WPBakery, which narrows the attack surface but still allows a determined attacker to compromise the victim’s browser sessions and potentially harvest credentials or malicious payloads. The stored nature of the XSS means that the malicious content persists until the site owner removes or sanitizes the affected content.