PT-2025-40470 · WordPress · Ultimate Viral Quiz

Nabil Irawan · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-10302

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Ultimate Viral Quiz plugin for WordPress versions prior to 1.0

Description The Ultimate Viral Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within the save options() function. This allows attackers to modify the plugin’s settings by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update The Ultimate Viral Quiz plugin to a version later than 1.0.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10302

Affected Products

Ultimate Viral Quiz

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10302 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve · Note
• https://t.me/cveNotify/137299 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28 · Note
• https://twitter.com/CVEnew/status/1974076239267725747 · Twitter Post