5.3
Medium
CVE-2023-6155 The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX…
Description
The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Quiz Maker 6.4 | earliest → < 6.4.9.5 | 6.4.9.5 |
Other CVEs of Quiz Maker
The 5 CVEs of Quiz Maker →
CVE-2025-14579
The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow…
4.8
Medium
CVE-2024-8617
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow…
4.8
Medium
CVE-2023-6166
The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes,…
Not rated
CVE-2023-2571
The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in…
6.1
Medium