CVE-2022-4220

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4220
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e Exploit Third Party Advisory
https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73 Patch Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= Patch Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/966a3a33-3d22-4671-8893-7a64ff838f39?source=cve
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220 Third Party Advisory
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e Exploit Third Party Advisory
https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73 Patch Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= Patch Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:kibokolabs:chained_quiz:*:*:*:*:*:wordpress:*:*
History

08 Apr 2026, 18:17

Type Values Removed Values Added
References
  • () https://www.wordfence.com/threat-intel/vulnerabilities/id/966a3a33-3d22-4671-8893-7a64ff838f39?source=cve -
CWE CWE-352

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - Exploit, Third Party Advisory () https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - Exploit, Third Party Advisory
References () https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73 - Patch, Third Party Advisory () https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73 - Patch, Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= - Patch, Third Party Advisory () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= - Patch, Third Party Advisory
References () https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220 - Third Party Advisory () https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220 - Third Party Advisory
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 5.4

07 Nov 2023, 03:57

Type Values Removed Values Added
CWE CWE-352
Information

Published : 2022-12-02 21:15

Updated : 2026-04-08 18:17

NVD link : CVE-2022-4220

Mitre link : CVE-2022-4220

CVE.ORG link : CVE-2022-4220

JSON object : View

Products Affected

kibokolabs

  • chained_quiz
CWE
CWE-352

Cross-Site Request Forgery (CSRF)