CVE-2023-47513 MEDIUM

CVE-2023-47513: WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerability

Vendor Ari Soft
Product ARI Stream Quiz
Weakness CWE-80 · XSS · basic
Published June 4, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.

Explanation of Vulnerability in Simple Terms

02Summary

ARI Stream Quiz versions up to 1.3.2 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level access can modify quiz content or settings to execute code in other users' browsers, potentially stealing session data or performing actions on their behalf. The vulnerability requires an authenticated account but no user interaction from the victim.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts into quiz content that execute in other users' browsers.

Potential impact on your site

04Site Impact

Quiz data and user sessions are at risk; attackers with basic access can compromise other users.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege authenticated account on the site.

Key dates

06Disclosure timeline

June 4, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-60100 WordPress XStore theme < 9.6 - Content Injection vulnerability CVE-2025-11265 VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-1834 Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-11745 Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2026-39712 WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability