CVE-2025-30774: High SQL Injection in WordPress Quiz Maker

CVE-2025-30774 is a high severity (CVSS 8.2) SQL injection in the Ays Pro Quiz Maker plugin for WordPress, in versions up to and including 6.6.8.7. Patchstack lists 6.6.8.8 as the patched version. Update the plugin to 6.6.8.8 or later on every site, and deactivate it if you cannot update at once.

What's affected

The record says Quiz Maker (the quiz-maker plugin from Ays Pro) is affected from the earliest version through 6.6.8.7.

Patchstack's database entry gives 6.6.8.8 as the patched version. It also lists the required privilege as unauthenticated, meaning no login is needed. The record itself does not state the privilege level, so rely on Patchstack for that point.

The record does not flag the CVE as known exploited, and the CVE is not in the CISA KEV catalog at the time of writing.

How to check if you're exposed

WordPress shows plugin versions in the admin and on the command line.

1. In the dashboard, open the Plugins page and find Quiz Maker. If the version is 6.6.8.7 or lower, update it.
2. With WP-CLI, run wp plugin list and look at the version for quiz-maker. You can also run wp plugin update quiz-maker.
3. On a multisite network, check every site, because the plugin may be active on only some.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project's dependency list includes an affected component, and the Gold directory lets you look up the CVE and its related weaknesses.

What to do now

1. Update the Quiz Maker plugin to 6.6.8.8 or later on every site.
2. If you cannot update now, deactivate the plugin until you can.
3. Check web logs for unusual requests to quiz pages and admin endpoints, and review the database for unexpected changes.
4. Use a database account with the permissions WordPress needs and no more, and keep backups.
5. Turn on automatic updates for plugins you rely on.

Why it matters

The record maps the flaw to CWE-89 (SQL Injection). The description says special elements used in an SQL command are not neutralized. In plain terms, input that should be data is mixed into a database query and can change its meaning.

A WordPress database holds user accounts, password hashes, content and plugin data, and quiz plugins can also hold respondent details. Patchstack notes that SQL injection of this kind lets an attacker read, modify or delete database content. Plugin flaws that need no login are attractive to mass scanners, so a short update window is wise.

The fix is already out, which makes this an easy win. Update, then confirm the version on each site.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Patchstack database entry

Last reviewed: 19 October 2026.