CVE-2024-10574

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting

State: Published
Severity: 7.2 High
Published: Jan 26, 2025
Updated: Jan 27, 2025
Reserved: Oct 30, 2024

Read the record on cve.org

Description

The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	Wordfence

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Quiz Maker DeveloperAYS Pro Plugins	21.8.0 and earlierAffected
Quiz Maker AgencyAYS Pro Plugins	31.8.0 and earlierAffected
Quiz Maker BusinessAYS Pro Plugins	8.8.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.