
Quiz Maker Security & Risk Analysis
wordpress.org/plugins/quiz-makerQUIZ MAKER plugin allows you to make an unlimited number of Quizzes, Exams and Tests
Is Quiz Maker Safe to Use in 2026?
Mostly Safe
Score 82/100Quiz Maker is generally safe to use. 22 past CVEs were resolved. Keep it updated.
The 'quiz-maker' v6.7.1.16 plugin presents a mixed security posture with significant concerns despite some positive aspects. While it demonstrates good practices in SQL query sanitization (84% prepared statements) and a high number of capability checks and nonce checks, the large attack surface, particularly the 39 unprotected AJAX handlers, is a critical weakness. The taint analysis reveals 14 high-severity flows without sanitization, indicating potential for exploitation. Furthermore, the plugin's history of 22 CVEs, including critical and high-severity vulnerabilities across common attack vectors like SQL Injection, XSS, and missing authorization, points to a recurring pattern of security flaws. The fact that the last vulnerability was recent (2026-02-19) suggests ongoing issues. While the absence of unpatched CVEs is a positive, the combination of unprotected entry points, critical taint flows, and a history of serious vulnerabilities necessitates a cautious approach.
Key Concerns
- Large attack surface without auth checks
- High severity taint flows
- Significant historical CVEs
- 1 critical historical CVE
- 5 high historical CVEs
- Bundled libraries (potential for vulns)
Quiz Maker Security Vulnerabilities
CVEs by Year
Severity Breakdown
22 total CVEs
Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery
Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content
Quiz Maker <= 6.5.9.8 - Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval
Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification
Quiz Maker <= 6.5.0.5 - Denial of Service
Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting
Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure
Quiz Maker <= 6.4.2.6 - Reflected Cross-Site Scripting
Quiz Maker <= 6.3.9.4 - Content Spoofing
Quiz Maker <= 6.2.0.8 - SQL Injection
Quiz Maker Code Analysis
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
Quiz Maker Attack Surface
AJAX Handlers 40
Shortcodes 39
WordPress Hooks 71
Maintenance & Trust
Quiz Maker Maintenance & Trust
Maintenance Signals
Community Trust
Quiz Maker Alternatives
HD Quiz
hd-quiz
Create a Quiz. An easy-to-use feature rich plugin to create quizzes with quiz timer, pagination, hints, advanced marking, and leading help and support
QuizFlow – AI-Powered Quiz Maker
quizflow
A powerful AI-powered quiz and survey maker allow you to create and manage unlimited quizes with advanced features and detailed submission tracking.
Quiz Maker – Save Progress
quiz-maker-save-progress
A plugin that Saves AYS Quiz Maker Progress
Acadlix – WordPress LMS for Courses, Quizzes & Exams
acadlix
Acadlix is a WordPress LMS plugin for creating and selling online courses, quizzes, exam-level test series, and assessments.
EmbedQuiz
embedquiz
This plugin connects WordPress to EmbedQuiz.com. Use Gutenberg Blocks, Shortcodes, and Legacy Widgets to embed quizzes on your website!
Quiz Maker Developer Profile
18 plugins · 111K total installs
How We Detect Quiz Maker
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/quiz-maker/admin/css/bootstrap-datepicker.min.css/wp-content/plugins/quiz-maker/admin/css/bootstrap-datepicker3.min.css/wp-content/plugins/quiz-maker/admin/css/bootstrap.min.css/wp-content/plugins/quiz-maker/admin/css/bootstrap4.min.css/wp-content/plugins/quiz-maker/admin/css/bootstrap-grid.css/wp-content/plugins/quiz-maker/admin/css/bootstrap-reboot.css/wp-content/plugins/quiz-maker/admin/css/flatpickr.min.css/wp-content/plugins/quiz-maker/admin/css/chosen.min.css+26 more/wp-content/plugins/quiz-maker/admin/js/bootstrap.bundle.min.js/wp-content/plugins/quiz-maker/admin/js/bootstrap.min.js/wp-content/plugins/quiz-maker/admin/js/bootstrap4.min.js/wp-content/plugins/quiz-maker/admin/js/bootstrap-datepicker.min.js/wp-content/plugins/quiz-maker/admin/js/bootstrap-datepicker.es.min.js/wp-content/plugins/quiz-maker/admin/js/flatpickr.min.js+10 morequiz-maker/style.css?ver=quiz-maker/script.js?ver=quiz-maker/admin/css/bootstrap.min.css?ver=quiz-maker/admin/css/bootstrap4.min.css?ver=quiz-maker/admin/css/bootstrap-grid.css?ver=quiz-maker/admin/css/bootstrap-reboot.css?ver=quiz-maker/admin/css/bootstrap-datepicker.min.css?ver=quiz-maker/admin/css/bootstrap-datepicker3.min.css?ver=quiz-maker/admin/css/flatpickr.min.css?ver=quiz-maker/admin/css/chosen.min.css?ver=quiz-maker/admin/css/quiz-maker-admin-style.css?ver=quiz-maker/admin/css/quiz-maker-admin-style-new.css?ver=quiz-maker/admin/css/quiz-maker-front-style.css?ver=quiz-maker/admin/css/quiz-maker-premium.css?ver=quiz-maker/admin/css/quiz-maker-style.css?ver=quiz-maker/admin/css/quiz-maker-style-new.css?ver=quiz-maker/admin/css/quiz-maker-style-premium.css?ver=quiz-maker/admin/css/quiz-maker-style-premium-new.css?ver=quiz-maker/admin/js/bootstrap.bundle.min.js?ver=quiz-maker/admin/js/bootstrap.min.js?ver=quiz-maker/admin/js/bootstrap4.min.js?ver=quiz-maker/admin/js/bootstrap-datepicker.min.js?ver=quiz-maker/admin/js/bootstrap-datepicker.es.min.js?ver=quiz-maker/admin/js/flatpickr.min.js?ver=quiz-maker/admin/js/chosen.jquery.min.js?ver=quiz-maker/admin/js/quiz-maker-admin-script.js?ver=quiz-maker/admin/js/quiz-maker-admin-script-new.js?ver=quiz-maker/admin/js/quiz-maker-script.js?ver=quiz-maker/admin/js/quiz-maker-script-new.js?ver=quiz-maker/admin/js/quiz-maker-script-premium.js?ver=quiz-maker/admin/js/quiz-maker-script-premium-new.js?ver=quiz-maker/admin/js/quiz-maker-script-premium-new-2.js?ver=quiz-maker/public/css/quiz-maker-front-style.css?ver=quiz-maker/public/css/quiz-maker-style.css?ver=quiz-maker/public/js/quiz-maker-script.js?ver=quiz-maker/public/js/quiz-maker-script-new.js?ver=HTML / DOM Fingerprints
ays-notice-bannerays-quiz-logo-container-upgradequiz-logoays-quiz-upgrade-containerays-quiz-svg-light-hoverays-quiz-coupon-containerays-quiz-coupon-boxays-quiz-copy-element-box-parent+5 more<!-- Start of Quiz Maker admin notice --><!-- Begin Quiz Maker Admin Notice --><!-- End Quiz Maker Admin Notice --><!-- This file is read by WordPress to generate the plugin information in the plugin
* admin area. This file also includes all of the dependencies used by the plugin,
* registers the activation and deactivation functions, and defines a function
* that starts the plugin. -->+15 moredata-quiz-iddata-quiz-form-iddata-user-iddata-attempt-iddata-quiz-start-timedata-quiz-end-time+19 morequiz_maker_ajax_objays_quiz_maker_is_chat_availableAYS_QUIZ_UTM_VERSIONQuizMakerAdminQuizMakerFrontquiz_maker_vars/wp-json/quiz-maker/v1/get_quiz/wp-json/quiz-maker/v1/submit_quiz/wp-json/quiz-maker/v1/get_results/wp-json/quiz-maker/v1/get_user_quizzes/wp-json/quiz-maker/v1/get_quiz_data[quiz-maker][quiz_maker]