CVE-2026-6817 is a stored cross-site scripting vulnerability in the Quiz Maker by AYS WordPress plugin affecting all versions up to 6.7.1.29. The vulnerability is due to improper neutralization of input in the 'rate_reason' parameter, allowing injection of arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability requires no privileges or user interaction to exploit and has a CVSS 3.1 score of 5.8 (medium). No official remediation or patch is currently documented.

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts into pages generated by the plugin. This can lead to limited confidentiality impact by exposing user session data or other information accessible in the browser context. There is no direct impact on integrity or availability reported. The vulnerability could be leveraged for phishing or session hijacking attacks against users of affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'rate_reason' parameter may provide temporary mitigation.