Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6.7.1.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
Our CTI team identified a lot of activities targeting ays-pro Quiz Maker Plugin (CVE-2026-6817) https://vuldb.com/vuln/360855/cti
Post summary
CTI analysis reports that the ays-pro Quiz Maker Plugin CVE‑2026‑6817 is being actively targeted, indicating real‑world exploitation activity.
CVE-2026-6817 Stored Cross-Site Scripting in Quiz Maker by AYS WordPress Plugin ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6817 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The text announces CVE-2026-6817, a stored XSS flaw in the Quiz Maker by AYS WordPress Plugin, linking to vulnerability details, but provides no PoC, exploit, or patch information.