CVE-2022-4218

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/49333c6b-58f6-4d5a-a605-46484160175a?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4218Third Party Advisory
• https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4218Third Party Advisory

Published

Dec 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42169Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerabil…9.8
• CVE-2022-4217The Chained Quiz plugin for WordPress is vulnerable to Store…4.8
• CVE-2022-42170Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerabil…9.8
• CVE-2022-42171Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerabil…9.8
• CVE-2022-42175Insecure Direct Object Reference vulnerability in WHMCS modu…8.8
• CVE-2022-42176In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credenti…7.8
• CVE-2022-42182Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Di…5.3
• CVE-2022-42183Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Se…9.1
• CVE-2022-42187Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_ju…6.1
• CVE-2022-42188In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to pa…7.5
• CVE-2022-42189Emlog Pro 1.6.0 plugins upload suffers from a remote code ex…7.2
• CVE-2022-4219The Chained Quiz plugin for WordPress is vulnerable to Cross…4.3