CVE
CVE-2025-6174
6.1
CVSSmedium
Exploitable remotely over the internet · no authentication required · user interaction needed.
Description
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
Attack Vector
Network
Privileges Req.
None
User Interaction
Required
qwizcards | online quizzes and flashcards
Updated Nov 7, 2026View on NVD →
This CVE is in S4E's catalog, but no public scanner is mapped to it yet.
CVE history: qwizcards | online quizzes and flashcards
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →