Quote Master
Quote Master has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Quote Master has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Abdulsamad Yusuf (0xVenus). Quote Master is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.2.39.
CVE-2025-68849Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Quote Master
Author
Frank Corso
This plugin gives you the ability to add, edit, and delete quotes and their authors. You can show a random quote from your list by using the [quotes] shortcode on any page or post. You can also use the included Quote Master widget! Features include: Add, edit, delete quotes Add, edit, delete categories Show random quote Show random quote only from selected category Show entire quotes list Show all quotes in selected category Include quote’s author Use shortcode on any post or page Built-in widget Add Tweet link to quote to allow visitors to tweet the quote Edit the style for the quotes Make Suggestions Or Contribute Quote Master is on GitHub!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C