Skip to content
Noroxi

Chained Quiz

chained-quiz · plugin

Known security vulnerabilities for Chained Quiz. Find out in seconds which version runs on your site with WP Lens.

20 known vulnerabilities

1 critical · 15 exploitable without logging in · 1 with public exploit code · latest Sep 18, 2025

Listed on wordpress.org · latest 1.4.1 · last updated Aug 5, 2026 · 1K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2018-14502unauthenticated

    controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrar

    Critical 9.8

  • CVE-2022-4215unauthenticated · needs a click≤ 1.3.2.3

    Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date

    Medium 6.1

  • CVE-2022-4214unauthenticated · needs a click≤ 1.3.2.3

    Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip

    Medium 6.1

  • CVE-2022-4213unauthenticated · needs a click≤ 1.3.2.2

    Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn

    Medium 6.1

  • CVE-2022-4212unauthenticated · needs a click≤ 1.3.2

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf

    Medium 6.1

  • CVE-2022-4211unauthenticated · needs a click≤ 1.3.2

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf

    Medium 6.1

  • CVE-2022-4210unauthenticated · needs a click≤ 1.3.2

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf

    Medium 6.1

  • CVE-2022-4209unauthenticated · needs a click≤ 1.3.2

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf

    Medium 6.1

  • CVE-2022-4208unauthenticated · needs a click≤ 1.3.2

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef

    Medium 6.1

  • CVE-2016-10892unauthenticated · needs a click

    The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.

    Medium 6.1

  • CVE-2025-10493unauthenticated≤ 1.3.5

    Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

    Medium 5.3

  • CVE-2024-37921unauthenticated≤ 1.3.2.8

    WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-37446high privilege≤ 1.3.2.8

    WordPress Chained Quiz plugin <= 1.3.2.8 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2023-25027admin≤ 1.3.2.5

    WordPress Chained Quiz Plugin <= 1.3.2.5 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

  • CVE-2022-4217admin≤ 1.3.2.2

    Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key

    Medium 4.8

  • CVE-2022-4216admin≤ 1.3.2.2

    Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID

    Medium 4.8

  • CVE-2025-24701high privilege≤ 1.3.2.9

    WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

    Medium 4.4

  • CVE-2022-4220unauthenticated · needs a click≤ 1.3.2.4

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion

    Medium 4.3

  • CVE-2022-4219unauthenticated · needs a click≤ 1.3.2.4

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion

    Medium 4.3

  • CVE-2022-4218unauthenticated · needs a click≤ 1.3.2.4

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory