High severity · published Aug 2, 2021
CVE-2021-24456
Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QM
Quiz Maker · Ays Pro
6.2.0.9 before 6.2.0.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24456
Third Party Advisory
https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4
More from Quiz Maker
9.8
CVE-2025-30774
WordPress Quiz Maker plugin <= 6.6.8.7 - SQL Injection vulnerability
9.8
CVE-2024-6028
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
7.5
CVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2025-58015
WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability
7.5
CVE-2025-10042
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection