CVE-2024-6810

The Quiz Organizer plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 2.9.1. The root cause is insufficient input sanitization and output escaping of user-supplied data, allowing arbitrary JavaScript to be stored in the database and executed when pages are loaded [1].

The vulnerability can only be exploited by authenticated attackers with administrator-level access. Successful exploitation requires either a WordPress multisite network installation or an environment where the unfiltered_html capability has been disabled for administrators [1]. Under these conditions, an attacker can inject malicious script content into plugin-generated pages.

When a victim (including other administrators or regular users) accesses a page containing the injected script, the arbitrary web scripts execute in their browser session. This can lead to session hijacking, defacement, or theft of sensitive information [1].

The plugin has been closed on the WordPress plugin repository since July 9, 2024, due to guideline violations. Users should remove the plugin and migrate to an alternative solution, as no patched version is available [1].