The Quiz Maker by AYS plugin for WordPress contains a Stored Cross‑Site Scripting flaw in the rate_reason parameter. Due to inadequate input validation and insufficient output escaping, unauthenticated users can embed arbitrary JavaScript code that will run whenever a page containing the injection is viewed. The vulnerability is a classic injection weakness (CWE‑79) that can lead to session hijacking, defacement, or delivery of malicious payloads to unsuspecting visitors.

The flaw affects all releases of the Quiz Maker by AYS plugin up to and including version 6.7.1.29. WordPress sites running any of these versions are vulnerable; updating to a later release removes the rate_reason handling that permits unsanitized input.

With a CVSS score of 5.8, the vulnerability presents moderate risk. Because the enhancer is accessible without authentication, attackers can exploit it remotely by sending a crafted request to the rate_reason field, and the injected script will execute for any user who loads the affected page. The EPSS score is currently unavailable, and the flaw is not listed in CISA’s KEV catalogue, indicating no confirmed widespread exploitation yet, but the lack of authentication makes it relatively easy to abuse.