Reflected Cross-Site Scripting in Chained Quiz Plugin for WordPress

CVE-2022-4211

Summary

The Chained Quiz plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit insufficient input sanitization in the 'emailf' parameter on the 'chainedquiz_list' page. By crafting a malicious link, an attacker can trick users into clicking it, which results in the execution of arbitrary web scripts on their browsers. This can lead to significant security risks, including data theft or malicious site interactions, emphasizing the importance of keeping plugins updated and employing stringent security practices.

References