Qwizcards - XSS (CVE-2025-6174)

CVE-2025-6174 is a reflected cross-site scripting (XSS) vulnerability in the Qwizcards online quizzes and flashcards WordPress plugin up to version 3.9.4. This flaw arises from improper sanitization of the "_stylesheet" parameter, allowing attackers to inject malicious scripts that could target high-privilege users, including site administrators. Exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-6174 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2025-6174 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the Qwizcards plugin by sending requests to /wp-content/plugins/qwiz-online-quizzes-and-flashcards/qwiz_admin_sample_buttons.php with a crafted theme_stylesheet parameter containing malicious JavaScript, resulting in reflected cross-site scripting.