Reflected Cross-Site Scripting in Qwizcards Plugin by WordPress
CVE-2025-6174
What is CVE-2025-6174?
The Qwizcards online quizzes and flashcards plugin for WordPress, versions up to 3.9.4, is vulnerable to a reflected cross-site scripting (XSS) flaw. The vulnerability arises because the plugin does not appropriately sanitize and escape the '_stylesheet' parameter before rendering it on the website. This lack of adequate input validation can allow attackers to craft malicious links, which if followed by users, especially those with higher privileges like administrators, could compromise their sessions and lead to unauthorized actions or data exposure.
Affected Version(s)
Qwizcards | online quizzes and flashcards 0 <= 3.9.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.