CVE-2022-4220

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/966a3a33-3d22-4671-8893-7a64ff838f39?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220Third Party Advisory
• https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220Third Party Advisory

Published

Dec 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42188In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to pa…7.5
• CVE-2022-42189Emlog Pro 1.6.0 plugins upload suffers from a remote code ex…7.2
• CVE-2022-4219The Chained Quiz plugin for WordPress is vulnerable to Cross…4.3
• CVE-2022-42197In Simple Exam Reviewer Management System v1.0 the User List…6.5
• CVE-2022-42198In Simple Exam Reviewer Management System v1.0 the User List…8.8
• CVE-2022-42199Simple Exam Reviewer Management System v1.0 is vulnerable to…8.8
• CVE-2022-42200Simple Exam Reviewer Management System v1.0 is vulnerable to…5.4
• CVE-2022-42201Simple Exam Reviewer Management System v1.0 is vulnerable to…7.2
• CVE-2022-42202TP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vul…6.1
• CVE-2022-42205PHPGurukul Hospital Management System In PHP V 4.0 is vulner…5.4
• CVE-2022-42206PHPGurukul Hospital Management System In PHP V 4.0 is vulner…5.4
• CVE-2022-4221Improper Neutralization of Special Elements used in an OS Co…9.8