What is CVE-2026-2384?

CVE-2026-2384 is a stored Cross-Site Scripting (XSS) vulnerability found in the Quiz Maker plugin for WordPress. It affects versions up to and including 6.7.1.7, allowing authenticated users with contributor-level access or higher to inject malicious scripts into pages via the `vc_quizmaker` shortcode.

How does the vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes in the `vc_quizmaker` shortcode. When an attacker crafts a shortcode with malicious JavaScript, it can be executed in the context of any user viewing the affected page.

Who is affected by this vulnerability?

Any WordPress site using the Quiz Maker plugin version 6.7.1.7 or earlier is at risk, particularly if it has users with contributor-level access or higher. Additionally, the WPBakery Page Builder plugin must be active for the vulnerability to be exploitable.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, check the version of the Quiz Maker plugin installed. If it is 6.7.1.7 or earlier, your site is susceptible to CVE-2026-2384. Review your user roles to identify any contributors or higher who may exploit this vulnerability.

What should I do to fix the vulnerability?

Upgrade the Quiz Maker plugin to version 6.7.1.8 or later, where the vulnerability has been patched. Ensure that all user inputs are properly sanitized and validated to prevent similar vulnerabilities in the future.

What does the CVSS score of 6.4 mean?

A CVSS score of 6.4 indicates a medium severity vulnerability. This means that while the vulnerability requires authenticated access to exploit, it can still pose significant risks, especially if exploited by users with elevated privileges.

How does the proof of concept demonstrate the issue?

The proof of concept outlines a method for an authenticated attacker to exploit the vulnerability by injecting a script via the shortcode attribute. It illustrates how an attacker can authenticate and submit a payload that executes on the victim’s browser.

What are the potential consequences of exploitation?

If successfully exploited, attackers can execute arbitrary JavaScript in the context of users viewing the compromised page. This could lead to session hijacking, unauthorized actions on behalf of users, or redirection to malicious sites.

What is stored Cross-Site Scripting (XSS)?

Stored XSS occurs when an attacker injects malicious scripts that are stored on the server and executed when users access the affected content. This type of XSS can have a broader impact as the payload persists and affects all users who view the compromised content.

How can I mitigate the risk of similar vulnerabilities?

To mitigate risks, always keep plugins and themes updated to their latest versions. Implement security measures such as input validation, output escaping, and regular security audits to identify and address vulnerabilities proactively.

What additional steps can I take to secure my WordPress site?

Consider using security plugins that offer features like firewall protection, malware scanning, and user role management. Regularly review user permissions and limit access to sensitive areas of your site to trusted users only.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-2384: Quiz Maker <= 6.7.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (quiz-maker)

CVE ID CVE-2026-2384

Plugin quiz-maker

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 6.7.1.7

Patched Version 6.7.1.8

Disclosed February 18, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-2384:
This vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw in the Quiz Maker WordPress plugin, affecting versions up to and including 6.7.1.7. The vulnerability resides in the plugin’s `vc_quizmaker` shortcode handler. Attackers with contributor-level permissions or higher can inject malicious scripts into pages. Successful exploitation requires the WPBakery Page Builder plugin to be active. The CVSS score of 6.4 reflects the medium severity of this privilege-dependent stored XSS.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping on user-supplied shortcode attributes. The vulnerability originates in the file `quiz-maker/admin/partials/quizes/actions/quiz-maker-quizes-actions.php`. The diff shows the plugin stored user-controlled data from the `$options[‘submit_redirect_url’]` and `$options[‘exit_redirect_url’]` arrays without proper validation. This data was later echoed directly into HTML attributes without escaping, as seen in lines referencing `$submit_redirect_url` and `$exit_redirect_url`.

Exploitation requires an authenticated attacker with at least contributor-level access. The attacker crafts a post or page containing the `vc_quizmaker` shortcode with malicious JavaScript payloads embedded within specific attributes, such as `submit_redirect_url` or `exit_redirect_url`. When the WPBakery Page Builder renders the shortcode, the unsanitized attribute values are output directly into the page’s HTML, causing script execution for any user viewing that page.

The patch addresses the vulnerability by applying proper output escaping functions. The diff shows the addition of `esc_url()` to sanitize the `$submit_redirect_url` variable on line 878 and the `$exit_redirect_url` variable on line 887. Furthermore, the patch adds escaping to numerous other output functions throughout the file, including `esc_html__()`, `esc_attr__()`, `esc_url()`, `wp_kses_post()`, and `intval()`. These changes ensure user-controlled data is safely encoded before being rendered in the browser context.

If successfully exploited, this vulnerability allows attackers to inject arbitrary JavaScript into pages. This script executes in the context of any user viewing the compromised page. Attackers can perform actions on behalf of the victim, such as stealing session cookies, performing requests to the WordPress backend, or redirecting users to malicious sites. The stored nature of the attack amplifies its impact, as the payload persists and affects all future visitors to the page.

Differential between vulnerable and patched code

Code Diff

--- a/quiz-maker/admin/partials/quizes/actions/quiz-maker-quizes-actions.php
+++ b/quiz-maker/admin/partials/quizes/actions/quiz-maker-quizes-actions.php
@@ -875,7 +875,7 @@
 // Redirect after submit
 $options['redirect_after_submit'] = (!isset($options['redirect_after_submit'])) ? 'off' : $options['redirect_after_submit'];
 $redirect_after_submit = isset($options['redirect_after_submit']) && $options['redirect_after_submit'] == 'on' ? true : false;
-$submit_redirect_url = isset($options['submit_redirect_url']) ? $options['submit_redirect_url'] : '';
+$submit_redirect_url = isset($options['submit_redirect_url']) ? esc_url($options['submit_redirect_url']) : '';
 $submit_redirect_delay = (isset($options['submit_redirect_delay']) && $options['submit_redirect_delay'] != "") ? esc_attr( absint($options['submit_redirect_delay']) ) : '';

 // Progress bar style
@@ -884,7 +884,7 @@
 // Exit button in finish page
 $options['enable_exit_button'] = (!isset($options['enable_exit_button'])) ? 'off' : $options['enable_exit_button'];
 $enable_exit_button = isset($options['enable_exit_button']) && $options['enable_exit_button'] == 'on' ? true : false;
-$exit_redirect_url = isset($options['exit_redirect_url']) ? $options['exit_redirect_url'] : '';
+$exit_redirect_url = isset($options['exit_redirect_url']) && $options['exit_redirect_url'] != '' ? esc_url($options['exit_redirect_url']) : '';

 // Question image sizing
 $image_sizing = (isset($options['image_sizing']) && $options['image_sizing'] != "") ? $options['image_sizing'] : 'cover';
@@ -7139,16 +7139,16 @@
                 <div class="ays-quiz-top-actions-container-wrapper form-group row">
                     <div class="col-sm-12">
                         <p class="m-0 text-right">
-                            <a class="ays-quiz-collapse-all" href="javascript:void(0);"><?php echo __( "Collapse All", "quiz-maker" ); ?></a>
+                            <a class="ays-quiz-collapse-all" href="javascript:void(0);"><?php echo esc_html__( "Collapse All", "quiz-maker" ); ?></a>
                             <span>|</span>
-                            <a class="ays-quiz-expand-all" href="javascript:void(0);"><?php echo __( "Expand All", "quiz-maker" ); ?></a>
+                            <a class="ays-quiz-expand-all" href="javascript:void(0);"><?php echo esc_html__( "Expand All", "quiz-maker" ); ?></a>
                         </p>
                     </div>
                 </div>
                 <div class="ays-quiz-accordion-options-main-container" data-collapsed="false">
                     <div class="ays-quiz-accordion-container">
                         <?php echo wp_kses($quiz_accordion_svg_html, $quiz_allowed_html); ?>
-                        <p class="ays-subtitle"><?php echo __('Primary','quiz-maker'); ?></p>
+                        <p class="ays-subtitle"><?php echo esc_html__('Primary','quiz-maker'); ?></p>
                     </div>
                     <hr class="ays-quiz-bolder-hr"/>
                     <div class="ays-quiz-accordion-options-box">
@@ -7157,7 +7157,7 @@
                                 <div class="ays-quiz-heading-box ays-quiz-unset-float ays-quiz-unset-margin">
                                     <div class="ays-quiz-wordpress-user-manual-box ays-quiz-wordpress-text-align">
                                         <a href="https://www.youtube.com/watch?v=DHolVT3O0Zk" target="_blank">
-                                            <?php echo __("How to create scored quiz - video", 'quiz-maker'); ?>
+                                            <?php echo esc_html__("How to create scored quiz - video", 'quiz-maker'); ?>
                                         </a>
                                     </div>
                                 </div>
@@ -7166,8 +7166,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_calculate_score">
-                                            <?php echo __('Calculate the score','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Calculate the score of results by the selected method.','quiz-maker')?>">
+                                            <?php echo esc_html__('Calculate the score','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Calculate the score of results by the selected method.','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7175,14 +7175,14 @@
                                     <div class="col-sm-8 pro_features_parent ays-quiz-pro-features-parent-box-display-flex">
                                         <label class="ays_quiz_loader">
                                             <input type="radio" class="ays-enable-timer1" value="by_correctness" tabindex="-1" checked/>
-                                            <span><?php echo __( "By correctness", 'quiz-maker' ); ?></span>
+                                            <span><?php echo esc_html__( "By correctness", 'quiz-maker' ); ?></span>
                                         </label>
                                         <label class="ays_quiz_loader only_pro ays-pro-features-v2-main-box">
                                             <div class="ays-pro-features-v2-small-buttons-box" style="right: -20px; top: -30px;">
                                                 <div class="ays-pro-features-v2-video-button ays-quiz-small-new-watch-video-button-box">
                                                     <div>
-                                                        <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/video_24x24.svg'?>">
-                                                        <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/video_24x24_hover.svg'?>" class="ays-quiz-new-watch-video-button-hover">
+                                                        <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/video_24x24.svg' ); ?>">
+                                                        <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/video_24x24_hover.svg' ); ?>" class="ays-quiz-new-watch-video-button-hover">
                                                     </div>
                                                 </div>
                                                 <a href="https://ays-pro.com/wordpress/quiz-maker?utm_source=dashboard&utm_medium=quiz-free&utm_campaign=calculate-the-score-<?php echo esc_attr( AYS_QUIZ_UTM_VERSION ); ?>" target="_blank" class="ays-pro-features-v2-upgrade-button">
@@ -7192,29 +7192,29 @@
                                             <div class="pro_features pro_features_popup" style="align-items: flex-end;justify-content: flex-end;">
                                                 <div class="pro-features-popup-conteiner">
                                                     <div class="pro-features-popup-title">
-                                                        <?php echo __("Calculate the score option", 'quiz-maker'); ?>
+                                                        <?php echo esc_html__("Calculate the score option", 'quiz-maker'); ?>
                                                     </div>
                                                     <div class="pro-features-popup-content" data-link="https://youtu.be/2OYoqJtsjoc">
                                                         <p>
-                                                            <?php echo sprintf( __("The option gives you the possibility to choose the most appropriate calculation system for your quiz. You can set the calculation method either %s by Correctness or by Weight/Points. %s", 'quiz-maker'),
+                                                            <?php echo wp_kses_post( sprintf( __("The option gives you the possibility to choose the most appropriate calculation system for your quiz. You can set the calculation method either %s by Correctness or by Weight/Points. %s", 'quiz-maker'),
                                                                 '<strong>',
                                                                 '</strong>'
-                                                            ); ; ?>
+                                                            ) ); ?>
                                                         </p>
                                                         <p>
-                                                            <?php echo __("You just need to configure the calculation system depending on the type of quiz you want to create.", 'quiz-maker'); ?>
+                                                            <?php echo esc_html__("You just need to configure the calculation system depending on the type of quiz you want to create.", 'quiz-maker'); ?>
                                                         </p>
                                                         <div>
-                                                            <a href="https://quiz-plugin.com/docs/" target="_blank"><?php echo __("See Documentation", 'quiz-maker'); ?></a>
+                                                            <a href="https://quiz-plugin.com/docs/" target="_blank"><?php echo esc_html__("See Documentation", 'quiz-maker'); ?></a>
                                                         </div>
                                                     </div>
                                                     <div class="pro-features-popup-button" data-link="https://ays-pro.com/wordpress/quiz-maker?utm_source=dashboard&utm_medium=quiz-free&utm_campaign=pro-popup-calculate-score-<?php echo esc_attr( AYS_QUIZ_UTM_VERSION ); ?>">
-                                                        <?php echo __("Pricing", 'quiz-maker'); ?>
+                                                        <?php echo esc_html__("Pricing", 'quiz-maker'); ?>
                                                     </div>
                                                 </div>
                                             </div>
                                             <input type="radio" class="ays-enable-timer1" tabindex="-1" value="by_points" disabled />
-                                            <span><?php echo __( "By weight / points", 'quiz-maker' ); ?></span>
+                                            <span><?php echo esc_html__( "By weight / points", 'quiz-maker' ); ?></span>
                                         </label>
                                     </div>
                                 </div>
@@ -7224,14 +7224,14 @@
                         <div class="form-group row ays-quiz-result-message-vars-parent">
                             <div class="col-sm-4">
                                 <label for="ays_result_text">
-                                    <?php echo __('Result message','quiz-maker')?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('The message will be displayed after submitting the quiz. You can use Variables (General Settings) to insert user data here. If you want to show results with points or with the number of correct answers, you need to use correspondent variables and enable the “Hide score” option.','quiz-maker')?>">
+                                    <?php echo esc_html__('Result message','quiz-maker')?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('The message will be displayed after submitting the quiz. You can use Variables (General Settings) to insert user data here. If you want to show results with points or with the number of correct answers, you need to use correspondent variables and enable the “Hide score” option.','quiz-maker')?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
                                 <p class="ays_quiz_small_hint_text_for_message_variables">
-                                    <span><?php echo __( "To see all Message Variables " , 'quiz-maker' ); ?></span>
-                                    <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo __( "click here" , 'quiz-maker' ); ?></a>
+                                    <span><?php echo esc_html__( "To see all Message Variables " , 'quiz-maker' ); ?></span>
+                                    <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo esc_html__( "click here" , 'quiz-maker' ); ?></a>
                                 </p>
                             </div>
                             <div class="col-sm-8">
@@ -7248,8 +7248,8 @@
                         <div class="form-group row">
                             <div class="col-sm-4">
                                 <label class="form-check-label" for="ays-pass-score">
-                                    <?php echo __("Pass Score (%)", 'quiz-maker') ?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Set the minimum score to pass the quiz in percentage. Please note to give a value to it above 0, otherwise, the Quiz pass message and Quiz fail message options will not work.','quiz-maker'); ?>">
+                                    <?php echo esc_html__("Pass Score (%)", 'quiz-maker') ?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Set the minimum score to pass the quiz in percentage. Please note to give a value to it above 0, otherwise, the Quiz pass message and Quiz fail message options will not work.','quiz-maker'); ?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7265,21 +7265,21 @@
                                             <div class="col-sm-12">
                                                 <label class="ays_quiz_loader">
                                                     <input type="radio" class="ays-enable-timer1" checked/>
-                                                    <span><?php echo __( "Percentage", 'quiz-maker' ); ?></span>
+                                                    <span><?php echo esc_html__( "Percentage", 'quiz-maker' ); ?></span>
                                                 </label>
                                                 <label class="ays_quiz_loader">
                                                     <input type="radio" class="ays-enable-timer1" />
-                                                    <span><?php echo __( "Points", 'quiz-maker' ); ?></span>
+                                                    <span><?php echo esc_html__( "Points", 'quiz-maker' ); ?></span>
                                                 </label>
                                             </div>
                                         </div>
                                         <a href="https://ays-pro.com/wordpress/quiz-maker?utm_source=dashboard&utm_medium=quiz-free&utm_campaign=pass-score-<?php echo esc_attr( AYS_QUIZ_UTM_VERSION ); ?>" target="_blank" class="ays-quiz-new-upgrade-button-link">
                                             <div class="ays-quiz-new-upgrade-button-box">
                                                 <div>
-                                                    <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/locked_24x24.svg'?>">
-                                                    <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/unlocked_24x24.svg'?>" class="ays-quiz-new-upgrade-button-hover">
+                                                    <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/locked_24x24.svg' ); ?>">
+                                                    <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/unlocked_24x24.svg' ); ?>" class="ays-quiz-new-upgrade-button-hover">
                                                 </div>
-                                                <div class="ays-quiz-new-upgrade-button"><?php echo __("Upgrade", "quiz-maker"); ?></div>
+                                                <div class="ays-quiz-new-upgrade-button"><?php echo esc_html__("Upgrade", "quiz-maker"); ?></div>
                                             </div>
                                         </a>
                                     </div>
@@ -7288,21 +7288,21 @@
                                 <?php endif; ?>
                                 <div class="form-group row">
                                     <div class="col-sm-12">
-                                         <input type="number" class="ays-text-input" id='ays-pass-score' name='ays_pass_score' value="<?php echo $pass_score; ?>"/>
+                                         <input type="number" class="ays-text-input" id='ays-pass-score' name='ays_pass_score' value="<?php echo intval($pass_score); ?>"/>
                                     </div>
                                 </div>
                                 <hr/>
                                 <div class="form-group row ays-quiz-result-message-vars-parent">
                                     <div class="col-sm-4">
                                         <label class="form-check-label" for="ays_pass_score_message">
-                                            <?php echo __("Quiz pass message", 'quiz-maker') ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('The message in the case of the user passes the quiz','quiz-maker')?>">
+                                            <?php echo esc_html__("Quiz pass message", 'quiz-maker') ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('The message in the case of the user passes the quiz','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
                                         <p class="ays_quiz_small_hint_text_for_message_variables">
-                                            <span><?php echo __( "To see all Message Variables " , 'quiz-maker' ); ?></span>
-                                            <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo __( "click here" , 'quiz-maker' ); ?></a>
+                                            <span><?php echo esc_html__( "To see all Message Variables " , 'quiz-maker' ); ?></span>
+                                            <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo esc_html__( "click here" , 'quiz-maker' ); ?></a>
                                         </p>
                                     </div>
                                     <div class="col-sm-8">
@@ -7325,15 +7325,15 @@
                                 <div class="form-group row ays-quiz-result-message-vars-parent">
                                     <div class="col-sm-4">
                                         <label class="form-check-label" for="ays_fail_score_message">
-                                            <?php echo __("Quiz fail message", 'quiz-maker') ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('The message in the case of the user fails the quiz','quiz-maker')?>">
+                                            <?php echo esc_html__("Quiz fail message", 'quiz-maker') ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('The message in the case of the user fails the quiz','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
                                         <br>
                                         <p class="ays_quiz_small_hint_text_for_message_variables">
-                                            <span><?php echo __( "To see all Message Variables " , 'quiz-maker' ); ?></span>
-                                            <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo __( "click here" , 'quiz-maker' ); ?></a>
+                                            <span><?php echo esc_html__( "To see all Message Variables " , 'quiz-maker' ); ?></span>
+                                            <a href="?page=quiz-maker-settings&ays_quiz_tab=tab4" target="_blank"><?php echo esc_html__( "click here" , 'quiz-maker' ); ?></a>
                                         </p>
                                     </div>
                                     <div class="col-sm-8">
@@ -7358,8 +7358,8 @@
                         <div class="form-group row">
                             <div class="col-sm-4">
                                 <label>
-                                    <?php echo __('Display score','quiz-maker')?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('How to display score of result','quiz-maker')?>">
+                                    <?php echo esc_html__('Display score','quiz-maker')?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('How to display score of result','quiz-maker')?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7367,11 +7367,11 @@
                             <div class="col-sm-8">
                                 <label class="ays_quiz_loader">
                                     <input type="radio" class="ays-enable-timer1" name="ays_display_score" value="by_percantage" <?php echo ($display_score == 'by_percantage') ? 'checked' : '' ?>/>
-                                    <span><?php echo __( "By percentage", 'quiz-maker' ); ?></span>
+                                    <span><?php echo esc_html__( "By percentage", 'quiz-maker' ); ?></span>
                                 </label>
                                 <label class="ays_quiz_loader">
                                     <input type="radio" class="ays-enable-timer1" name="ays_display_score" value="by_correctness" <?php echo ($display_score == 'by_correctness') ? 'checked' : '' ?>/>
-                                    <span><?php echo __( "By correct answers count", 'quiz-maker' ); ?></span>
+                                    <span><?php echo esc_html__( "By correct answers count", 'quiz-maker' ); ?></span>
                                 </label>
                             </div>
                         </div><!-- Display score -->
@@ -7379,8 +7379,8 @@
                         <div class="form-group row">
                             <div class="col-sm-4">
                                 <label for="ays_hide_score">
-                                    <?php echo __('Hide score','quiz-maker')?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Disable to show the user score with percentage on the finish page. If you want to show points or correct answers count, you need to tick this option and use Variables (General Settings) in the “Text for showing after quiz completion” option.','quiz-maker')?>">
+                                    <?php echo esc_html__('Hide score','quiz-maker')?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Disable to show the user score with percentage on the finish page. If you want to show points or correct answers count, you need to tick this option and use Variables (General Settings) in the “Text for showing after quiz completion” option.','quiz-maker')?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7395,8 +7395,8 @@
                         <div class="form-group row ays_toggle_parent">
                             <div class="col-sm-4">
                                 <label for="ays_redirect_after_submit">
-                                    <?php echo __('Redirect after submission','quiz-maker'); ?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Redirect to custom URL after user submit the form.','quiz-maker'); ?>">
+                                    <?php echo esc_html__('Redirect after submission','quiz-maker'); ?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Redirect to custom URL after user submit the form.','quiz-maker'); ?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7410,8 +7410,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_submit_redirect_url">
-                                            <?php echo __('Redirect URL','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('The URL for redirecting after the user submits the form.','quiz-maker')?>">
+                                            <?php echo esc_html__('Redirect URL','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('The URL for redirecting after the user submits the form.','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7419,7 +7419,7 @@
                                     <div class="col-sm-8">
                                         <input type="text" class="ays-text-input" id="ays_submit_redirect_url"
                                             name="ays_submit_redirect_url"
-                                            value="<?php echo $submit_redirect_url; ?>"/>
+                                            value="<?php echo esc_url($submit_redirect_url); ?>"/>
                                     </div>
                                 </div>
                                 <div class="form-group row" style="margin:0px;">
@@ -7439,10 +7439,10 @@
                                         <a href="https://ays-pro.com/wordpress/quiz-maker?utm_source=dashboard&utm_medium=quiz-free&utm_campaign=redirect-url-hook-<?php echo esc_attr( AYS_QUIZ_UTM_VERSION ); ?>" target="_blank" class="ays-quiz-new-upgrade-button-link">
                                             <div class="ays-quiz-new-upgrade-button-box">
                                                 <div>
-                                                    <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/locked_24x24.svg'?>">
-                                                    <img loading="lazy" src="<?php echo AYS_QUIZ_ADMIN_URL.'/images/icons/unlocked_24x24.svg'?>" class="ays-quiz-new-upgrade-button-hover">
+                                                    <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/locked_24x24.svg' ); ?>">
+                                                    <img loading="lazy" src="<?php echo esc_url( AYS_QUIZ_ADMIN_URL.'/images/icons/unlocked_24x24.svg' ); ?>" class="ays-quiz-new-upgrade-button-hover">
                                                 </div>
-                                                <div class="ays-quiz-new-upgrade-button"><?php echo __("Upgrade", "quiz-maker"); ?></div>
+                                                <div class="ays-quiz-new-upgrade-button"><?php echo esc_html__("Upgrade", "quiz-maker"); ?></div>
                                             </div>
                                         </a>
                                     </div>
@@ -7451,8 +7451,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_submit_redirect_delay">
-                                            <?php echo __('Redirect delay (sec)', 'quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('The redirection delay in seconds after the user submits the form. Value should be greater than 0.','quiz-maker')?>">
+                                            <?php echo esc_html__('Redirect delay (sec)', 'quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('The redirection delay in seconds after the user submits the form. Value should be greater than 0.','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7460,21 +7460,21 @@
                                     <div class="col-sm-8">
                                         <input type="number" class="ays-text-input" id="ays_submit_redirect_delay"
                                             name="ays_submit_redirect_delay"
-                                            value="<?php echo $submit_redirect_delay; ?>"/>
+                                            value="<?php echo intval($submit_redirect_delay); ?>"/>
                                     </div>
                                 </div>
                                 <hr/>
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_message_before_redirect_timer">
-                                            <?php echo __('Message before redirect timer','quiz-maker'); ?>
+                                            <?php echo esc_html__('Message before redirect timer','quiz-maker'); ?>
                                             <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr( __('Write a message to display before the timer. For example, "You will be redirected in 00:30".','quiz-maker') ); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
                                     </div>
                                     <div class="col-sm-8">
-                                        <input type="text" class="ays-text-input" id="ays_quiz_message_before_redirect_timer" name="ays_quiz_message_before_redirect_timer" value="<?php echo $quiz_message_before_redirect_timer; ?>"/>
+                                        <input type="text" class="ays-text-input" id="ays_quiz_message_before_redirect_timer" name="ays_quiz_message_before_redirect_timer" value="<?php echo esc_attr($quiz_message_before_redirect_timer); ?>"/>
                                     </div>
                                 </div>
                             </div>
@@ -7485,15 +7485,15 @@
                 <div class="ays-quiz-accordion-options-main-container" data-collapsed="false">
                     <div class="ays-quiz-accordion-container">
                         <?php echo wp_kses($quiz_accordion_svg_html, $quiz_allowed_html); ?>
-                        <p class="ays-subtitle"><?php echo __('Completion Actions','quiz-maker'); ?></p>
+                        <p class="ays-subtitle"><?php echo esc_html__('Completion Actions','quiz-maker'); ?></p>
                     </div>
                     <hr class="ays-quiz-bolder-hr"/>
                     <div class="ays-quiz-accordion-options-box">
                         <div class="form-group row">
                             <div class="col-sm-4">
                                 <label>
-                                    <?php echo __('Quiz loader icon','quiz-maker')?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Choose the design of the loader on the finish page after submitting. It will inherit the Quiz Text color from the Styles tab.','quiz-maker')?>">
+                                    <?php echo esc_html__('Quiz loader icon','quiz-maker')?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Choose the design of the loader on the finish page after submitting. It will inherit the Quiz Text color from the Styles tab.','quiz-maker')?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7527,39 +7527,39 @@
                                 <label class="ays_quiz_loader">
                                     <input name="ays_quiz_loader" class="ays_toggle_loader_radio" data-flag="true" data-type="text" type="radio" value="text" <?php echo ($quiz_loader == 'text') ? 'checked' : ''; ?>>
                                     <div class="ays_quiz_loader_text">
-                                        <?php echo __( "Text" , 'quiz-maker' ); ?>
+                                        <?php echo esc_html__( "Text" , 'quiz-maker' ); ?>
                                     </div>
                                     <div class="ays_toggle_loader_target <?php echo ($quiz_loader == 'text') ? '' : 'display_none' ?>" data-type="text">
-                                        <input type="text" class="ays-text-input" data-type="text" id="ays_quiz_loader_text_value" name="ays_quiz_loader_text_value" value="<?php echo $quiz_loader_text_value; ?>">
+                                        <input type="text" class="ays-text-input" data-type="text" id="ays_quiz_loader_text_value" name="ays_quiz_loader_text_value" value="<?php echo esc_attr($quiz_loader_text_value); ?>">
                                     </div>
                                 </label>
                                 <label class="ays_quiz_loader">
                                     <input name="ays_quiz_loader" class="ays_toggle_loader_radio" data-flag="true" data-type="gif" type="radio" value="custom_gif" <?php echo ($quiz_loader == 'custom_gif') ? 'checked' : ''; ?>>
                                     <div class="ays_quiz_loader_custom_gif">
-                                        <?php echo __( "Gif" , 'quiz-maker' ); ?>
+                                        <?php echo esc_html__( "Gif" , 'quiz-maker' ); ?>
                                     </div>
                                     <div class="ays_toggle_loader_target ays-image-wrap <?php echo ($quiz_loader == 'custom_gif') ? '' : 'display_none' ?>" data-type="gif">
-                                        <a href="javascript:void(0)" style="<?php echo ($quiz_loader_custom_gif == '') ? 'display:inline-block' : 'display:none'; ?>" class="ays-add-image add_quiz_loader_custom_gif"><?php echo __('Add Gif', 'quiz-maker'); ?></a>
-                                        <input type="hidden" class="ays-image-path" id="ays_quiz_loader_custom_gif" name="ays_quiz_loader_custom_gif" value="<?php echo $quiz_loader_custom_gif; ?>"/>
+                                        <a href="javascript:void(0)" style="<?php echo ($quiz_loader_custom_gif == '') ? 'display:inline-block' : 'display:none'; ?>" class="ays-add-image add_quiz_loader_custom_gif"><?php echo esc_html__('Add Gif', 'quiz-maker'); ?></a>
+                                        <input type="hidden" class="ays-image-path" id="ays_quiz_loader_custom_gif" name="ays_quiz_loader_custom_gif" value="<?php echo esc_url($quiz_loader_custom_gif); ?>"/>
                                         <div class="ays-image-container" style="<?php echo ($quiz_loader_custom_gif == '') ? 'display:none' : 'display:block'; ?>">
                                             <span class="ays-edit-img ays-edit-quiz-loader-custom-gif">
                                                 <i class="ays_fa ays_fa_pencil_square_o"></i>
                                             </span>
                                             <span class="add_quiz_loader_custom_gif ays-remove-quiz-loader-custom-gif"></span>
-                                            <img loading="lazy"  src="<?php echo $quiz_loader_custom_gif; ?>" class="img_quiz_loader_custom_gif"/>
+                                            <img loading="lazy"  src="<?php echo esc_url($quiz_loader_custom_gif); ?>" class="img_quiz_loader_custom_gif"/>
                                         </div>
                                     </div>
                                     <div class="ays_toggle_loader_target ays_gif_loader_width_container <?php echo ($quiz_loader == 'custom_gif') ? 'display_flex' : 'display_none'; ?>" data-type="gif" style="margin: 10px;">
                                         <div>
                                             <label for='ays_quiz_loader_custom_gif_width'>
-                                                <?php echo __('Width (px)', 'quiz-maker'); ?>
-                                                <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Custom Gif width in pixels. It accepts only numeric values.','quiz-maker'); ?>">
+                                                <?php echo esc_html__('Width (px)', 'quiz-maker'); ?>
+                                                <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Custom Gif width in pixels. It accepts only numeric values.','quiz-maker'); ?>">
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
                                         </div>
                                         <div style="margin-left: 5px;">
-                                            <input type="number" class="ays-text-input" id='ays_quiz_loader_custom_gif_width' name='ays_quiz_loader_custom_gif_width' value="<?php echo ( $quiz_loader_custom_gif_width ); ?>"/>
+                                            <input type="number" class="ays-text-input" id='ays_quiz_loader_custom_gif_width' name='ays_quiz_loader_custom_gif_width' value="<?php echo intval( $quiz_loader_custom_gif_width ); ?>"/>
                                         </div>
                                     </div>
                                 </label>
@@ -7569,8 +7569,8 @@
                         <div class="form-group row ays_toggle_parent">
                             <div class="col-sm-4">
                                 <label for="ays_enable_restart_button">
-                                    <?php echo __('Enable restart button','quiz-maker')?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Show the restart button at the end of the quiz for restarting the quiz and pass it again.','quiz-maker')?>">
+                                    <?php echo esc_html__('Enable restart button','quiz-maker')?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Show the restart button at the end of the quiz for restarting the quiz and pass it again.','quiz-maker')?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7584,14 +7584,14 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_show_restart_button_on_quiz_fail">
-                                            <?php echo __('Show button on quiz fail', 'quiz-maker'); ?>
+                                            <?php echo esc_html__('Show button on quiz fail', 'quiz-maker'); ?>
                                             <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr(__('If this option is activated the "Restart" button will be displayed only when the user failed the quiz.', 'quiz-maker')); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
                                     </div>
                                     <div class="col-sm-8">
-                                        <input type="checkbox" class="ays-enable-timer1" id="ays_quiz_show_restart_button_on_quiz_fail" name="ays_quiz_show_restart_button_on_quiz_fail" value="on" <?php echo ($quiz_show_restart_button_on_quiz_fail) ? 'checked' : '' ?>/>
+                                        <input type="checkbox" class="ays-enable-timer1" id="ays_quiz_show_restart_button_on_quiz_fail" name="ays_quiz_show_restart_button_on_quiz_fail" value="on" <?php echo ($quiz_show_restart_button_on_quiz_fail) ? 'checked' : ''; ?>/>
                                     </div>
                                 </div>
                             </div><!-- Show button on quiz fail -->
@@ -7600,8 +7600,8 @@
                         <div class="form-group row ays_toggle_parent">
                             <div class="col-sm-4">
                                 <label for="ays_questions_result_option">
-                                    <?php echo __('Show question results on the results page','quiz-maker'); ?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Show all questions with right and wrong answers after quiz','quiz-maker'); ?>">
+                                    <?php echo esc_html__('Show question results on the results page','quiz-maker'); ?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Show all questions with right and wrong answers after quiz','quiz-maker'); ?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7613,8 +7613,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_hide_correct_answers">
-                                            <?php echo __('Hide correct answers','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('After enabling this option, the user whose chosen answer to the question is wrong will not see the right one.','quiz-maker')?>">
+                                            <?php echo esc_html__('Hide correct answers','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('After enabling this option, the user whose chosen answer to the question is wrong will not see the right one.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7627,8 +7627,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_show_wrong_answers_first">
-                                            <?php echo __('Show wrong answers first','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Tick the checkbox if you want to show the wrongly answered questions by the particular user in the first place on the result page.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Show wrong answers first','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Tick the checkbox if you want to show the wrongly answered questions by the particular user in the first place on the result page.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7641,8 +7641,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_show_only_wrong_answers">
-                                            <?php echo __('Show only wrong answers','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Tick this option if you want to see only the wrong answers on the quiz results page.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Show only wrong answers','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Tick this option if you want to see only the wrong answers on the quiz results page.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7655,8 +7655,8 @@
                                 <div class="form-group row ays_toggle_parent">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_enable_results_toggle">
-                                            <?php echo __('Enable the Show/Hide toggle','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('If you enable this option, a toggle will be displayed by which you can show/hide the results of the quiz questions on the Front-end.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Enable the Show/Hide toggle','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('If you enable this option, a toggle will be displayed by which you can show/hide the results of the quiz questions on the Front-end.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7686,8 +7686,8 @@
                         <div class="form-group row">
                             <div class="col-sm-4">
                                 <label for="ays_enable_bar_option">
-                                    <?php echo __('Enable progress bar','quiz-maker'); ?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Show score via progressbar','quiz-maker'); ?>">
+                                    <?php echo esc_html__('Enable progress bar','quiz-maker'); ?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Show score via progressbar','quiz-maker'); ?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7702,8 +7702,8 @@
                         <div class="form-group row">
                             <div class="col-sm-4" style="padding-right: 0px;">
                                 <label for="ays_enable_quiz_rate">
-                                    <?php echo __('Enable quiz assessment','quiz-maker'); ?>
-                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Comment and rate the quiz with up to 5 stars at the end of the quiz.','quiz-maker'); ?>">
+                                    <?php echo esc_html__('Enable quiz assessment','quiz-maker'); ?>
+                                    <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Comment and rate the quiz with up to 5 stars at the end of the quiz.','quiz-maker'); ?>">
                                         <i class="ays_fa ays_fa_info_circle"></i>
                                     </a>
                                 </label>
@@ -7717,8 +7717,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4" style="padding-right: 0px;">
                                         <label for="ays_enable_rate_comments">
-                                            <?php echo __('Show the last 5 reviews','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Show the last 5 reviews after rating the quiz.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Show the last 5 reviews','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Show the last 5 reviews after rating the quiz.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7733,8 +7733,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_make_responses_anonymous">
-                                            <?php echo __('Make responses anonymous','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Collect anonymous responses no matter the quiz taker is a logged-in user or guest.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Make responses anonymous','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Collect anonymous responses no matter the quiz taker is a logged-in user or guest.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7747,8 +7747,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_enable_user_cհoosing_anonymous_assessment">
-                                            <?php echo __("Enable users' anonymous assessment",'quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('By ticking this option, the users can choose to leave a rating anonymously.','quiz-maker'); ?>">
+                                            <?php echo esc_html__("Enable users' anonymous assessment",'quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('By ticking this option, the users can choose to leave a rating anonymously.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7762,8 +7762,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_make_all_review_link">
-                                            <?php echo __('Display all reviews button','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Tick the option, and the quiz taker will have the opportunity to see all feedbacks written by others.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Display all reviews button','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Tick the option, and the quiz taker will have the opportunity to see all feedbacks written by others.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7776,8 +7776,8 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_review_enable_comment_field">
-                                            <?php echo __('Enable Comment Field','quiz-maker'); ?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('By disabling this option, the comment field will be hidden and you can only rate with stars. This option is enabled by default.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Enable Comment Field','quiz-maker'); ?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('By disabling this option, the comment field will be hidden and you can only rate with stars. This option is enabled by default.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7790,7 +7790,7 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_make_review_required">
-                                            <?php echo __('Make the review field required','quiz-maker'); ?>
+                                            <?php echo esc_html__('Make the review field required','quiz-maker'); ?>
                                             <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr( __("If this option is enabled, the users can't send a feedback without writing a review.",'quiz-maker') ); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
@@ -7804,22 +7804,22 @@
                                 <div class="form-group row">
                                     <div class="col-sm-4">
                                         <label for="ays_quiz_review_placeholder_text">
-                                            <?php echo __('Placeholder text','quiz-maker'); ?>
+                                            <?php echo esc_html__('Placeholder text','quiz-maker'); ?>
                                             <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr( __('Write your custom placeholder for the Rating form.','quiz-maker') ); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
                                     </div>
                                     <div class="col-sm-8">
-                                        <input type="text" class="ays-text-input" id="ays_quiz_review_placeholder_text" name="ays_quiz_review_placeholder_text" value="<?php echo $quiz_review_placeholder_text; ?>"/>
+                                        <input type="text" class="ays-text-input" id="ays_quiz_review_placeholder_text" name="ays_quiz_review_placeholder_text" value="<?php echo esc_attr($quiz_review_placeholder_text); ?>"/>
                                     </div>
                                 </div>
                                 <hr>
                                 <div class="form-group row ays-quiz-result-message-vars-parent">
                                     <div class="col-sm-4" style="padding-right: 0px;">
                                         <label for="ays_rate_form_title">
-                                            <?php echo __('Rating form title','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('Text which will notify user that he can submit a feedback','quiz-maker')?>">
+                                            <?php echo esc_html__('Rating form title','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('Text which will notify user that he can submit a feedback','quiz-maker')?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7838,8 +7838,8 @@
                                 <div class="form-group row ays-quiz-result-message-vars-parent">
                                     <div class="col-sm-4" style="padding-right: 0px;">
                                         <label for="ays_quiz_review_thank_you_message">
-                                            <?php echo __('Thank you message','quiz-maker')?>
-                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo __('By enabling this option, the text written in the editor is displayed when the user writes a review for the quiz.','quiz-maker'); ?>">
+                                            <?php echo esc_html__('Thank you message','quiz-maker')?>
+                                            <a class="ays_help" data-toggle="tooltip" title="<?php echo esc_attr__('By enabling this option, the text written in the editor is displayed when the user writes a review for the quiz.','quiz-maker'); ?>">
                                                 <i class="ays_fa ays_fa_info_circle"></i>
                                             </a>
                                         </label>
@@ -7862,15 +7862,15 @@
                 <div class="ays-quiz-accordion-options-main-container" data-collapsed="false">
                     <div class="ays-quiz-accordion-container">
                         <?php echo wp_kses($quiz_accordion_svg_html, $q

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2384 - Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin-ajax.php';
$username = 'contributor_user';
$password = 'contributor_pass';

// Payload to inject via the shortcode attribute
$payload = '"><script>alert(document.domain)</script>';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');

// Step 1: Authenticate to WordPress (simplified - real PoC would need nonce from login form)
// This is a conceptual outline. A full PoC requires handling the WordPress nonce system.
echo "[!] This PoC is a conceptual demonstration. A full exploit requires handling WordPress nonces and the post creation API.n";
echo "[+] Target: $target_urln";
echo "[+] Vulnerability: Stored XSS in vc_quizmaker shortcode.n";
echo "[+] Attack Vector: Create a post/page with a malicious shortcode like:n";
echo "    [vc_quizmaker submit_redirect_url="$payload"]n";
echo "[+] Requirement: Attacker must have contributor+ permissions and WPBakery Page Builder active.n";

// The actual attack would involve:
// 1. Logging in via wp-login.php and obtaining a valid session/nonce.
// 2. Using the WordPress REST API or admin-ajax.php to create a new post.
// 3. Setting the post content to include the malicious shortcode.
// Example shortcode payload:
// [vc_quizmaker submit_redirect_url="javascript:alert('XSS')"]
// OR
// [vc_quizmaker exit_redirect_url=""><script>alert(1)</script>"]

?>

Frequently Asked Questions

What is CVE-2026-2384?
Overview of the vulnerability
CVE-2026-2384 is a stored Cross-Site Scripting (XSS) vulnerability found in the Quiz Maker plugin for WordPress. It affects versions up to and including 6.7.1.7, allowing authenticated users with contributor-level access or higher to inject malicious scripts into pages via the `vc_quizmaker` shortcode.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes in the `vc_quizmaker` shortcode. When an attacker crafts a shortcode with malicious JavaScript, it can be executed in the context of any user viewing the affected page.
Who is affected by this vulnerability?
Identifying vulnerable users
Any WordPress site using the Quiz Maker plugin version 6.7.1.7 or earlier is at risk, particularly if it has users with contributor-level access or higher. Additionally, the WPBakery Page Builder plugin must be active for the vulnerability to be exploitable.
How can I check if my site is vulnerable?
Steps for verification
To determine if your site is vulnerable, check the version of the Quiz Maker plugin installed. If it is 6.7.1.7 or earlier, your site is susceptible to CVE-2026-2384. Review your user roles to identify any contributors or higher who may exploit this vulnerability.
What should I do to fix the vulnerability?
Immediate remediation steps
Upgrade the Quiz Maker plugin to version 6.7.1.8 or later, where the vulnerability has been patched. Ensure that all user inputs are properly sanitized and validated to prevent similar vulnerabilities in the future.
What does the CVSS score of 6.4 mean?
Understanding severity levels
A CVSS score of 6.4 indicates a medium severity vulnerability. This means that while the vulnerability requires authenticated access to exploit, it can still pose significant risks, especially if exploited by users with elevated privileges.
How does the proof of concept demonstrate the issue?
Explaining the PoC
The proof of concept outlines a method for an authenticated attacker to exploit the vulnerability by injecting a script via the shortcode attribute. It illustrates how an attacker can authenticate and submit a payload that executes on the victim’s browser.
What are the potential consequences of exploitation?
Risks associated with the vulnerability
If successfully exploited, attackers can execute arbitrary JavaScript in the context of users viewing the compromised page. This could lead to session hijacking, unauthorized actions on behalf of users, or redirection to malicious sites.
What is stored Cross-Site Scripting (XSS)?
Definition and implications
Stored XSS occurs when an attacker injects malicious scripts that are stored on the server and executed when users access the affected content. This type of XSS can have a broader impact as the payload persists and affects all users who view the compromised content.
How can I mitigate the risk of similar vulnerabilities?
Best practices for security
To mitigate risks, always keep plugins and themes updated to their latest versions. Implement security measures such as input validation, output escaping, and regular security audits to identify and address vulnerabilities proactively.
What additional steps can I take to secure my WordPress site?
Enhancing overall security
Consider using security plugins that offer features like firewall protection, malware scanning, and user role management. Regularly review user permissions and limit access to sensitive areas of your site to trusted users only.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations