Reflected Cross-Site Scripting in Chained Quiz Plugin for WordPress
CVE-2022-4212
6.1MEDIUM
Summary
The Chained Quiz plugin for WordPress suffers from a vulnerability that allows for Reflected Cross-Site Scripting through the 'ipf' parameter on the 'chainedquiz_list' page. This flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary scripts into web pages. If users interact with malicious links, their browsers may execute these scripts, leading to potential data theft or unauthorized actions on their behalf.
Affected Version(s)
Chained Quiz * <= 1.3.2
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Muhammad Zeeshan (Xib3rR4dAr)