diff --git a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingQuiz.java b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingQuiz.java
new file mode 100644
index 0000000000..a032faadf5
--- /dev/null
+++ b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingQuiz.java
@@ -0,0 +1,51 @@
+package org.owasp.webgoat.plugin;
+
+import org.owasp.webgoat.assignments.AssignmentEndpoint;
+import org.owasp.webgoat.assignments.AssignmentPath;
+import org.owasp.webgoat.assignments.AttackResult;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import java.io.IOException;
+
+
+/**
+ * @TODO: Get JSON from file not from hardcoded string
+ * add a question: 1. Append new question to JSON string
+ * 2. add right solution to solutions array
+ * 3. add Request param with name of question to method head
+ */
+@AssignmentPath("/cross-site-scripting/quiz")
+public class CrossSiteScriptingQuiz extends AssignmentEndpoint {
+
+        String[] solutions = {"Solution 4", "Solution 3", "Solution 1", "Solution 2", "Solution 4"};
+
+        @RequestMapping(method = RequestMethod.POST)
+        @ResponseBody
+        public AttackResult completed(@RequestParam String[] question_0_solution, @RequestParam String[] question_1_solution, @RequestParam String[] question_2_solution, @RequestParam String[] question_3_solution, @RequestParam String[] question_4_solution) throws IOException {
+            boolean correct = false;
+            String[][] solutionsInput = {question_0_solution, question_1_solution, question_2_solution, question_3_solution, question_4_solution};
+            int counter = 0;
+            for(String[] sa : solutionsInput) {
+                for(String s : sa) {
+                    if(sa.length == 1 && s.contains(this.solutions[counter])) {
+                        correct = true;
+                        break;
+                    } else {
+                        correct = false;
+                        continue;
+                    }
+                }
+                if(!correct) break;
+                counter++;
+            }
+            if(correct) {
+                return trackProgress(success().build());
+            } else {
+                return trackProgress(failed().build());
+            }
+        }
+
+    }
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScripting.html b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScripting.html
index b4d3e74224..680be7edde 100644
--- a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScripting.html
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScripting.html
@@ -170,4 +170,26 @@ <h1>Shopping Cart</h1>
 		<div class="attack-output"></div>
 	</div>
 </div>
+
+<div class="lesson-page-wrapper">
+	<span id="quiz_id" data-quiz_id="cross_site_scripting"></span>
+	<script th:src="@{/js/quiz.js}" language="JavaScript"></script>
+	<link rel="import" type="application/json" th:href="@{/lesson_js/questions.json}"/>
+	<div class="adoc-content" th:replace="doc:CrossSiteScripting_quiz.adoc"></div>
+	<div class="attack-container">
+		<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+		<div class="container-fluid">
+			<form id="quiz-form" class="attack-form" accept-charset="UNKNOWN"
+				  method="POST" name="form"
+				  action="/WebGoat/cross-site-scripting/quiz"
+				  enctype="application/json;charset=UTF-8" role="form">
+				<div id="q_container"></div>
+				<br />
+				<input name="Quiz_solutions" value="Submit answers" type="SUBMIT"/>
+			</form>
+		</div>
+		<div class="attack-feedback"></div>
+		<div class="attack-output"></div>
+	</div>
+</div>
 </html>
\ No newline at end of file
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/js/questions_cross_site_scripting.json b/webgoat-lessons/cross-site-scripting/src/main/resources/js/questions_cross_site_scripting.json
new file mode 100644
index 0000000000..29666e90a2
--- /dev/null
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/js/questions_cross_site_scripting.json
@@ -0,0 +1,43 @@
+{
+  "questions": [{
+    "text": "Are trusted websites immune to XSS attacks?",
+    "solutions": {
+      "1": "Yes, they're safe because the browser checks the code before executing.",
+      "2": "Yes, because Google has got an algorithm that blocks malicious code.",
+      "3": "No, because the script that's executed will break through the browser's defense algorithm.",
+      "4": "No, because the browser trusts the website if it's acknowledged trusted, then the browser doesn't know that the script is malicious."
+    }
+  }, {
+    "text": "When do XSS attacks occur?",
+    "solutions": {
+      "1": "Data enters a web application through a trusted source.",
+      "2": "Data enters a browser application through the website.",
+      "3": "The data is included in dynamic content that is sent to a web user without being validated for malicious content.",
+      "4": "The data is excluded in static content, that way it is sent without being validated."
+    }
+  }, {
+    "text": "What are Stored XSS attacks?",
+    "solutions": {
+      "1": "The script is permanently stored on the server and the victim gets the malicious script when requesting information from the server.",
+      "2": "The script stores itself on the victim's computer and executes locally the malicious code.",
+      "3": "The script stores a virus on the victim's computer. The attacker can perform various actions now.",
+      "4": "The script is stored in the browser and sends information to the attacker."
+    }
+  }, {
+    "text": "What are Reflected XSS attacks?",
+    "solutions": {
+      "1": "Reflected attacks reflect malicious code from the database to the web server and then reflect it back to the user.",
+      "2": "They reflect the injected script off the web server. That occurs when input sent to the web server is part of the request.",
+      "3": "Reflected attacks reflect from the server's firewall off to the database where the user requests information from.",
+      "4": "Reflected XSS is an attack where the injected script is reflected off the database and web server to the user."
+    }
+  }, {
+    "text": "Is Javascript the only way to perform XSS attacks?",
+    "solutions": {
+      "1": "Yes, you can only make use of tags through Javascript.",
+      "2": "Yes, otherwise you can't steal cookies.",
+      "3": "No, there's ECMAScript too.",
+      "4": "No, there're many other ways. Like HTML, Flash or any other type of code that the browser executes."
+    }
+  }]
+}
\ No newline at end of file
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_quiz.adoc b/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_quiz.adoc
new file mode 100644
index 0000000000..183bc7c8d0
--- /dev/null
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/lessonPlans/en/CrossSiteScripting_quiz.adoc
@@ -0,0 +1 @@
+Now it's time for a quiz! It's recommended to check the OWASP Cross Site Scripting explanations https://www.owasp.org/index.php/Cross-site_Scripting_(XSS). Answer all questions correctly to complete the assignment.
\ No newline at end of file