# CVE-2025-6174: Qwizcards - XSS

> Live exploitation tracking for CVE-2025-6174 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-6174

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** Qwizcards
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** wordpress

## Description

The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.

## CrowdSec analysis

[CVE-2025-6174](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-6174) is a reflected cross-site scripting (XSS) vulnerability in the Qwizcards online quizzes and flashcards WordPress plugin up to version 3.9.4. This flaw arises from improper sanitization of the "_stylesheet" parameter, allowing attackers to inject malicious scripts that could target high-privilege users, including site administrators. Exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-6174 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-6174 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the Qwizcards plugin by sending requests to `/wp-content/plugins/qwiz-online-quizzes-and-flashcards/qwiz_admin_sample_buttons.php` with a crafted `theme_stylesheet` parameter containing malicious JavaScript, resulting in reflected cross-site scripting.

## Timeline

- 2025-07-23: CVE Published. CVE-2025-6174 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2025-6174 exploitation attempts against the CrowdSec Network.
- 2025-11-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-6174 for the first time.

## References

- https://wpscan.com/vulnerability/ff827f67-712e-4ab6-b6aa-7f5e6ff1283a/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6174.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-6174) follows observed exploitation activity for CVE-2025-6174. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.