CVE-2022-4217

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-421709.8Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.CVE-2022-421719.8Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/saveParentControlInfo.CVE-2022-421758.8Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of oth CVE-2022-421767.8In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.CVE-2022-42184.3The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to CVE-2022-421825.3Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal.CVE-2022-421839.1Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2022-421876.1Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.CVE-2022-421887.5In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.CVE-2022-421897.2Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.CVE-2022-42194.3The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to CVE-2022-421976.5In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify