WordPress plugin
Chained Quiz security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 25 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High1
- Medium23
- Low0
All Chained Quiz vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.4.1Update to 1.4.2 | CVE-2026-108494 | |
| Medium5.3 | Unauthenticated Insecure Direct Object Reference via Cookie ≤1.3.5Update to 1.3.6 | CVE-2025-10493 | |
| Medium5.5 | Authenticated (Admin+) Server-Side Request Forgery ≤1.3.2.9Update to 1.3.3 | CVE-2025-24701 | |
| Medium5.3 | Missing Authorization ≤1.3.2.8Update to 1.3.2.9 | CVE-2024-37921 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.3.2.8Update to 1.3.2.9 | CVE-2024-37446 | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting ≤1.3.2.5Update to 1.3.2.6 | CVE-2023-25027 | |
| Medium6.1 | Reflected Cross-Site Scripting via ip ≤1.3.2.3Update to 1.3.2.4 | CVE-2022-4214 | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key ≤1.3.2.2Update to 1.3.2.3 | CVE-2022-4217 | |
| Medium5.4 | Cross-Site Request Forgery to Question Deletion ≤1.3.2.4Update to 1.3.2.5 | CVE-2022-4220 | |
| Medium6.1 | Reflected Cross-Site Scripting via ipf ≤1.3.2Update to 1.3.2.1 | CVE-2022-4212 | |
| Medium6.1 | Reflected Cross-Site Scripting via dnf ≤1.3.2Update to 1.3.2.1 | CVE-2022-4210 | |
| Medium6.1 | Reflected Cross-Site Scripting via date ≤1.3.2.3Update to 1.3.2.4 | CVE-2022-4215 | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID ≤1.3.2.2Update to 1.3.2.3 | CVE-2022-4216 | |
| Medium6.1 | Reflected Cross-Site Scripting via pointsf ≤1.3.2Update to 1.3.2.1 | CVE-2022-4209 | |
| Medium5.4 | Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying ≤1.3.2.4Update to 1.3.2.5 | CVE-2022-4218 | |
| Medium6.1 | Reflected Cross-Site Scripting via datef ≤1.3.2Update to 1.3.2.1 | CVE-2022-4208 | |
| Medium6.1 | Reflected Cross-Site Scripting via emailf ≤1.3.2Update to 1.3.2.1 | CVE-2022-4211 | |
| Medium6.1 | Reflected Cross-Site Scripting via dn ≤1.3.2.2Update to 1.3.2.3 | CVE-2022-4213 | |
| Medium5.4 | Cross-Site Request Forgery to Submitted Response Deletion ≤1.3.2.4Update to 1.3.2.5 | CVE-2022-4219 | |
| Medium5.4 | Cross-Site Scripting <1.2.7.2Update to 1.2.7.2 | CVE-2021-24690 | |
| Medium6.4 | Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting ≤1.1.9Update to 1.1.9.1 | — | |
| Medium6.1 | Reflected Cross-Site Scripting <1.1.8.2Update to 1.1.8.2 | CVE-2020-7104 | |
| Critical9.8 | Unauthenticated SQL Injection <1.0.9Update to 1.0.9 | CVE-2018-14502 | |
| Medium6.1 | Cross-Site Scripting <1.0Update to 1.0 | CVE-2016-10892 | |
| Medium6.4 | Cross-Site Scripting ≤0.9.8Update to 0.9.9 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.4.1Update to 1.4.2
- Medium5.3Unauthenticated Insecure Direct Object Reference via Cookie
≤1.3.5Update to 1.3.6
- Medium5.5Authenticated (Admin+) Server-Side Request Forgery
≤1.3.2.9Update to 1.3.3
- Medium5.3Missing Authorization
≤1.3.2.8Update to 1.3.2.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.3.2.8Update to 1.3.2.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
≤1.3.2.5Update to 1.3.2.6
- Medium6.1Reflected Cross-Site Scripting via ip
≤1.3.2.3Update to 1.3.2.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key
≤1.3.2.2Update to 1.3.2.3
- Medium5.4Cross-Site Request Forgery to Question Deletion
≤1.3.2.4Update to 1.3.2.5
- Medium6.1Reflected Cross-Site Scripting via ipf
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via dnf
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via date
≤1.3.2.3Update to 1.3.2.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID
≤1.3.2.2Update to 1.3.2.3
- Medium6.1Reflected Cross-Site Scripting via pointsf
≤1.3.2Update to 1.3.2.1
- Medium5.4Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying
≤1.3.2.4Update to 1.3.2.5
- Medium6.1Reflected Cross-Site Scripting via datef
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via emailf
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via dn
≤1.3.2.2Update to 1.3.2.3
- Medium5.4Cross-Site Request Forgery to Submitted Response Deletion
≤1.3.2.4Update to 1.3.2.5
- Medium5.4Cross-Site Scripting
<1.2.7.2Update to 1.2.7.2
- Medium6.4Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting
≤1.1.9Update to 1.1.9.1
- Medium6.1Reflected Cross-Site Scripting
<1.1.8.2Update to 1.1.8.2
- Critical9.8Unauthenticated SQL Injection
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
<1.0Update to 1.0
- Medium6.4Cross-Site Scripting
≤0.9.8Update to 0.9.9
Chained Quiz: common questions
Does Chained Quiz have known vulnerabilities?
Yes. VulnCrest Radar lists 25 known vulnerabilities in Chained Quiz: 1 critical, 1 high, 23 medium. None are known to affect version null.
How do I check which version of Chained Quiz I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Chained Quiz vulnerability?
CVE-2026-108494, published Oct 13, 2026: Chained Quiz <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Chained Quiz vulnerability listed in CISA KEV?
No. None of the known Chained Quiz vulnerabilities is currently listed in the CISA KEV catalog.