CVE-2026-2384: Quiz Maker WordPress Plugin XSS Flaw

CVE-2026-2384 Overview

The Quiz Maker plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the vc_quizmaker shortcode affecting all versions up to and including 6.7.1.7. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes within the shortcode implementation. This security flaw enables authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages, which execute whenever any user accesses the compromised page.

This vulnerability requires the WPBakery Page Builder plugin to be installed and active on the WordPress site, creating a specific attack surface for sites utilizing this popular page builder combination.

Critical Impact

Authenticated attackers with contributor-level access can inject malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, defacement, or malware distribution through the affected WordPress site.

Affected Products

• Quiz Maker plugin for WordPress versions up to and including 6.7.1.7
• WordPress sites with WPBakery Page Builder installed and active
• All WordPress installations running vulnerable Quiz Maker versions with contributor-level user accounts

Discovery Timeline

• 2026-02-20 - CVE CVE-2026-2384 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-2384

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Quiz Maker plugin's integration with WPBakery Page Builder. The vulnerable component is located in the quiz_maker_wpbvc.php template file, specifically in the handling of the vc_quizmaker shortcode.

When users with contributor-level privileges create or edit content using the WPBakery Page Builder interface, they can leverage the vc_quizmaker shortcode to embed quiz functionality. However, the plugin fails to properly sanitize and escape user-controlled attributes passed to this shortcode before rendering them in the page output.

The vulnerability classification under CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that attacker-supplied input is not adequately validated or encoded before being reflected in the generated HTML output. This allows JavaScript code embedded in shortcode attributes to persist in the database and execute in the context of any user's browser session when viewing the affected page.

The attack requires network access and authenticated contributor-level privileges, but once the malicious payload is stored, it affects all users who view the compromised page without requiring further attacker interaction.

Root Cause

The root cause of CVE-2026-2384 is insufficient input sanitization and output escaping in the Quiz Maker plugin's WPBakery integration module. The quiz_maker_wpbvc.php template file processes user-supplied shortcode attributes without applying proper WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses() before outputting the content to the page.

This oversight allows malicious script content embedded in shortcode parameters to bypass security controls and be rendered directly in the HTML output, creating a persistent XSS condition.

Attack Vector

The attack vector for this vulnerability requires the following conditions:

1. Authentication: The attacker must have a valid WordPress account with contributor-level access or higher
2. Plugin Dependencies: Both Quiz Maker (vulnerable version) and WPBakery Page Builder must be installed and active
3. Content Creation: The attacker creates or modifies a page/post using WPBakery, inserting the vc_quizmaker shortcode with malicious JavaScript payloads in vulnerable attributes
4. Persistence: The malicious script is stored in the WordPress database
5. Execution: When any user (including administrators) views the page containing the malicious shortcode, the injected script executes in their browser context

The vulnerability exploitation mechanism involves crafting shortcode attributes that include JavaScript event handlers or script tags that bypass the insufficient filtering mechanisms. For detailed technical information about the vulnerable code paths, see the WordPress Quiz Maker Template source code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-2384

Indicators of Compromise

• Unexpected JavaScript code or event handlers present in post/page content containing vc_quizmaker shortcodes
• Unusual shortcode attributes with encoded characters, script tags, or event handlers like onload, onerror, or onclick
• Reports from users experiencing unexpected redirects, pop-ups, or browser warnings when viewing quiz pages
• Suspicious contributor-level account activity focused on creating or editing pages with quiz shortcodes

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in WordPress shortcode parameters
• Deploy content security policy (CSP) headers to restrict inline script execution and report violations
• Conduct regular database audits scanning wp_posts table for suspicious JavaScript patterns within shortcode content
• Monitor WordPress revision history for unexpected modifications to pages containing Quiz Maker shortcodes

Monitoring Recommendations

• Enable WordPress audit logging to track all content modifications by contributor-level users
• Configure browser-side CSP violation reporting to identify attempted XSS exploitation
• Set up alerts for new or modified pages containing vc_quizmaker shortcodes from contributor accounts
• Review server access logs for unusual patterns of page views that may indicate XSS payload testing

How to Mitigate CVE-2026-2384

Immediate Actions Required

• Update the Quiz Maker plugin to the latest version that addresses this vulnerability
• Audit all existing pages and posts that use the vc_quizmaker shortcode for malicious content
• Review contributor-level user accounts and remove unnecessary access privileges
• Implement Content Security Policy headers to mitigate the impact of any stored XSS payloads

Patch Information

Organizations should update the Quiz Maker plugin to a patched version released after 6.7.1.7. Check the official WordPress plugin repository for the latest security update. Additional details about the vulnerability and remediation guidance are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Quiz Maker plugin until a patched version can be applied
• Remove contributor-level access from untrusted users until the vulnerability is remediated
• If WPBakery integration is not required, deactivate WPBakery Page Builder to eliminate the attack surface
• Deploy a WAF with XSS protection rules specifically monitoring WordPress shortcode parameters

# Configuration example
# Add Content Security Policy header to wp-config.php or .htaccess
# Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# Nginx (server block):
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";