CVE-2024-10633

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content

State: Published
Severity: 7.3 High
Published: Jan 26, 2025
Updated: Jan 27, 2025
Reserved: Oct 31, 2024

Read the record on cve.org

Description

The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	Wordfence

Weaknesses

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Affected Products

Product	Versions
Quiz Maker DeveloperAYS Pro Plugins	21.8.0 and earlierAffected
Quiz Maker AgencyAYS Pro Plugins	31.8.0 and earlierAffected
Quiz Maker BusinessAYS Pro Plugins	8.8.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.