CVE-2019-12517

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.

• CWE-79

• http://packetstormsecurity.com/files/154439/WordPress-SlickQuiz-1.3.7.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/slickquiz/#developersProduct
• http://packetstormsecurity.com/files/154439/WordPress-SlickQuiz-1.3.7.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/slickquiz/#developersProduct

Published

Sep 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12510In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker…9.1
• CVE-2019-12511In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacke…9.8
• CVE-2019-12512In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker…6.1
• CVE-2019-12513In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending …6.1
• CVE-2019-12515There is an out-of-bounds read vulnerability in the function…
• CVE-2019-12516The slickquiz plugin through 1.3.7.1 for WordPress allows SQ…8.8
• CVE-2019-12518Anviz CrossChex access control management software 4.3.8.0 a…9.8
• CVE-2019-12519An issue was discovered in Squid through 4.7. When handling …9.8
• CVE-2019-1252An information disclosure vulnerability exists when the Wind…6.5
• CVE-2019-12520An issue was discovered in Squid through 4.7 and 5. When rec…7.5
• CVE-2019-12521An issue was discovered in Squid through 4.7. When Squid is …5.9
• CVE-2019-12522An issue was discovered in Squid through 4.7. When Squid is …4.5