Security Alert Summary
The Quiz Maker WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in some of its settings input handling. The flaw is caused by missing sanitisation and escaping of settings, which can allow high-privilege users (for example, administrators) to introduce malicious script that is stored and later executed in affected pages. The CVE entry notes this can occur even when the unfiltered_html capability is disallowed, such as in multisite environments.
CVE Details
- CVE ID: CVE-2025-14579
- Affected plugin / component: Quiz Maker WordPress plugin
- Affected versions: Versions before 6.7.0.89
- Published: January 12, 2026 at 6:16:10 AM UTC
- Last modified: January 12, 2026 at 6:16:10 AM UTC
- CVSS v3.1 base score, severity, vector: Not specified in the CVE entry
- Authentication requirements / privileges required / user interaction: The issue requires a high-privilege authenticated user (for example, an administrator). The CVE notes exploitation by high-privilege users; detailed CVSS-derived interaction or user interaction flags are not specified in the entry.
- Primary impact: Confidentiality: may be impacted; Integrity: may be impacted; Availability: not indicated
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue caused by the plugin not sanitising and escaping some of its settings before storing or outputting them. Because certain settings are not properly handled, a high-privilege user can save malicious script into those settings. That script may later be rendered in pages viewed by users, resulting in execution of attacker-controlled JavaScript in the context of the site.
The CVE description does not name specific functions, REST API endpoints, or code paths. It does explicitly note that the lack of sanitisation/escaping affects some settings and that the vulnerability can be exploited even when the unfiltered_html capability is disallowed (for example, in multisite setups), indicating the missing checks are at the plugin settings handling level rather than relying on WordPress-wide capabilities.
Impact is limited to what stored XSS typically allows: execution of script in affected user sessions and pages. The CVE entry does not provide details about post-exploitation actions or confirm specific data exfiltration methods.
How This Could Impact Your Website
Consider a site with multiple user roles: a site owner, internal staff with elevated accounts, and external contractors or contributors. If a high-privilege account is permitted to edit the vulnerable settings, an attacker with access to such an account could store malicious JavaScript that executes when other users view affected pages or the admin interface. Practical consequences may include exposure of session tokens or ability to perform actions in the context of other users, and the content injected could be used to harvest visible data such as user names or email addresses, increasing the risk of targeted phishing or social engineering against staff.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and any accounts with elevated privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior that could indicate exploitation.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
