Read the docs
TI-2021-06745 Aliases CVE-2021-24456GHSA-3454-mhwg-vp35

Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard

Why it matters now

EPSS 0.01292 70th percentileScored 2026-11-07
Fix Fixed Quiz Maker (Ays Pro): 6.2.0.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ays ProQuiz Maker6.2.0.9 to before 6.2.0.96.2.0.9Patch availableCNA
  • Quiz Maker VendorAys Pro Affected 6.2.0.9 to before 6.2.0.9 Fixed in 6.2.0.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*before 6.2.0.9VulnerableAys Pro
  • cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:* Versions before 6.2.0.9 Vulnerable ·Ays Pro

Remediation

  • Fix · CNA Quiz Maker (Ays Pro) Fixed in 6.2.0.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24456
  2. 2026-10-03 Alias added: GHSA-3454-mhwg-vp35

References

Advisory 1

  • TI-2024-09849 Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id CVSS 3.1HIGH 7.5
  • TI-2023-05660 Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure CVSS 3.1MEDIUM 5.3
  • TI-2024-05586 Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter CVSS 3.1CRITICAL 9.8
  • TI-2023-02403 Quiz Maker < 6.4.2.7 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2024-07993 Quiz Maker <= 6.5.9.8 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2025-09218 Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences