Reflected Cross-Site Scripting Vulnerability in Chained Quiz WordPress Plugin
CVE-2022-4210
6.1MEDIUM
Summary
The Chained Quiz plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability due to inadequate sanitization and escaping of the 'dnf' parameter in the 'chainedquiz_list' page. This flaw allows unauthenticated attackers to inject malicious scripts into web pages, which could execute in the browser of users who follow a deceptive link. Proper input validation and escaping practices are essential to mitigate this risk and protect users from potential attacks.
Affected Version(s)
Chained Quiz * <= 1.3.2
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Muhammad Zeeshan (Xib3rR4dAr)