CVE-2022-4209mediumCWE-79

CVE-2022-4209: medium-severity vulnerability in prasunsen Chained Quiz

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf

Published · Updated

Follow this CVE+ Monitor Chained Quiz

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.9%
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
prasunsen · Chained Quiz
Related CVEs — prasunsen Chained Quiz

In the same product, most dangerous first.

CVE-2022-4215MEDIUMChained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via dateEPSS 1.0%CVE-2025-10493MEDIUMChained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via CookieEPSS 0.9%CVE-2022-4212MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfEPSS 0.9%CVE-2022-4211MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfEPSS 0.9%CVE-2022-4210MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfEPSS 0.9%CVE-2022-4208MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefEPSS 0.9%