CVE-2024-10633 - CVE House
Back to Database
Status published High CVE-2024-10633

Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content

Vulnerability Description

The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10633

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • abrahack

References

More from AYS Pro Plugins

View All →
CVE-2024-22027
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior...
Unknown 0
CVE-2024-10636
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content
Medium 6.1
CVE-2024-10628
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id
High 7.5
CVE-2024-10574
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting
High 7.2
CVE-2023-35764
Insufficient verification of data authenticity issue in Survey Maker prior...
Unknown 0

Affected Vendor

AYS Pro Plugins

View all reports →

Affected Software

Quiz Maker Developer, Quiz Maker Agency, Quiz Maker Business
Vulnerable Versions:
*

Timeline

Official Publish: January 26th, 2025
Last Modified: January 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.