Reflected Cross-Site Scripting Vulnerability in Chained Quiz WordPress Plugin
CVE-2022-4210

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Chained Quiz
Vendor
CVE Published:
2 December 2022

What is CVE-2022-4210?

The Chained Quiz plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability due to inadequate sanitization and escaping of the 'dnf' parameter in the 'chainedquiz_list' page. This flaw allows unauthenticated attackers to inject malicious scripts into web pages, which could execute in the browser of users who follow a deceptive link. Proper input validation and escaping practices are essential to mitigate this risk and protect users from potential attacks.

Affected Version(s)

Chained Quiz * <= 1.3.2

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba...
https://www.wordfence.com/vulnerability-advisories-contin...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Zeeshan (Xib3rR4dAr)
.