Lucene search
PRIOn knowledge basePRION:CVE-2022-4217HistoryDec 02, 2022 - 9:15 p.m.
Cross site scripting
2022-12-0221:15:00
PRIOn knowledge base
www.prio-n.com
5
wordpress
cross-site scripting
chained quiz plugin
stored
vulnerable
input sanitization
output escaping
administrative privileges
arbitrary web scripts.
0.001 Low
EPSS
Percentile
34.0%
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
| CPE | Name | Operator | Version |
|---|---|---|---|
| chained_quiz | le | 1.3.2.2 |
References
gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
plugins.trac.wordpress.org/changeset/2824193
plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail=
www.wordfence.com/vulnerability-advisories-continued/
Related
nvd
nvd
CVE-2022-4217
2022-12-02 21:15:11
cve
cve
CVE-2022-4217
2022-12-02 21:15:11
cvelist
cvelist
CVE-2022-4217
2022-12-02 20:58:25
wpvulndb
wpvulndb
Chained Quiz < 1.3.2.3 - Admin+ Stored XSS
2022-12-02 00:00:00