CVE-2022-4219

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submitted quiz responses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 2, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-421976.5In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modifyCVE-2022-421988.8In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.CVE-2022-421998.8Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.CVE-2022-42204.3The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to CVE-2022-422005.4Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.CVE-2022-422017.2Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.CVE-2022-422026.1TP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vulnerable to Cross Site Scripting (XSS).CVE-2022-422055.4PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php.CVE-2022-422065.4PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patieCVE-2022-42219.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthentCVE-2022-422187.2Open Source SACCO Management System v1.0 vulnerable to SQL Injection via /sacco_shield/manage_loan.php.CVE-2022-42229.8A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query
CVE-2022-4219: Medium severity, CVSS 4.3 | Vulnix