CVE-2026-2384: Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's vcquizmaker shortcode in all versions up to, and including, 6.7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This vulnerability requires WPBakery Page Builder to be installed and active
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2384?
CVE-2026-2384 is classified as a medium severity vulnerability due to its potential impact when exploited.
How do I fix CVE-2026-2384?
To mitigate CVE-2026-2384, upgrade the Quiz Maker plugin to a version higher than 6.7.1.7.
What type of vulnerability is CVE-2026-2384?
CVE-2026-2384 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Quiz Maker plugin.
Who is affected by CVE-2026-2384?
All users of the Quiz Maker plugin for WordPress running version 6.7.1.7 or earlier are affected by CVE-2026-2384.
What can an attacker do with CVE-2026-2384?
An attacker exploiting CVE-2026-2384 can execute arbitrary JavaScript code in the context of the user's browser, potentially stealing sensitive information.