Cross-Site Scripting Vulnerability in SlickQuiz Plugin for WordPress
CVE-2019-12517

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Slickquiz
Vendor: CVE Published:; 13 September 2019

What is CVE-2019-12517?

An XSS vulnerability in the SlickQuiz plugin for WordPress allows unauthenticated users to exploit the save_quiz_score functionality at the /wp-admin/admin-ajax.php endpoint. This vulnerability permits attackers to submit quiz solutions, which are stored in the database and later displayed in the WordPress backend. As a result, when these solutions contain malicious scripts, they can be triggered within the admin interface for all users having at least Subscriber rights. The lack of proper validation and sanitization for input fields, such as name and email, enables the execution of these scripts, putting all users at risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch