LeadQuizzes
LeadQuizzes has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for LeadQuizzes has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by 0xd4rk5id3. LeadQuizzes is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.
CVE-2025-31738LeadQuizzes <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
LeadQuizzes
Author
yazamodeveloper
Most businesses struggle to generate high quality leads but LeadQuizzes has set out to change this. With LeadQuizzes you can capture contact information like name, email, and phone number before or after your quiz as well as capture leads through a web form or let your quiz takers submit their name and email through their Facebook login. Never miss the perfect moment to ask for the sale. Putting a clever quiz on your website could help generate leads as well as make different product recommendations based on the user’s responses. With the wordpress plugin and shortcode there are endless options for where to put your quiz and have it look and work great!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C