Cross-Site Request Forgery in Chained Quiz Plugin for WordPress

CVE-2022-4218

Summary

The Chained Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in the list_quizzes() function. This vulnerability allows unauthenticated attackers to manipulate quizzes on a site by tricking the site administrator into executing actions, such as clicking a malicious link. Versions of the plugin up to and including 1.3.2.4 are affected, potentially leading to unauthorized quiz deletions or duplications without the admin's consent.

References