Ays Pro
Vulnerability activity for Ays Pro: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighOct 19, 2026Ays Pro Quiz Maker XSSCVE-2026-110379Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
- 4.8MediumOct 16, 2026Ays-Pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups Code / command injectionCVE-2026-100159The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token
- 7.6HighJun 26, 2026Ays Pro Popup box SQL injectionCVE-2026-57631Administrator SQL Injection in Popup box <= 6.0.1 versions.
- 5.4MediumApr 7, 2026Ays-Pro popup box SSRFCVE-2025-15611The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
- 4.3MediumDec 9, 2025Ays-Pro quiz maker CSRFCVE-2025-67595Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.82.
- 5.3MediumNov 19, 2025Ays-Pro quiz maker Information disclosureCVE-2025-12426The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data incl
- 6.1MediumJun 5, 2023Ays-Pro survey maker XSSCVE-2023-2572The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Top products
- Quiz Maker3 CVEs in the last year
- Popup box2 CVEs in the last year
- Popup Box – Create Countdown, Coupon, Video, Contact Form Popups1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.