CVE-2025-10493mediumCWE-639

CVE-2025-10493: medium-severity vulnerability in prasunsen Chained Quiz

Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

Published · Updated

Follow this CVE+ Monitor Chained Quiz

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.9%
from disclosure to weapon98 days
Published on NVDSep 18
1st PoC+98d
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
prasunsen · Chained Quiz
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — prasunsen Chained Quiz

In the same product, most dangerous first.

CVE-2022-4215MEDIUMChained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via dateEPSS 1.0%CVE-2022-4212MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfEPSS 0.9%CVE-2022-4211MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfEPSS 0.9%CVE-2022-4210MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfEPSS 0.9%CVE-2022-4209MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfEPSS 0.9%CVE-2022-4208MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefEPSS 0.9%