CVE-2022-4217 Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key

What is CVE-2022-4217?

CVE-2022-4217 is a medium-severity cross-site scripting vulnerability in prasunsen Chained Quiz, published on 2 Dec 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Weakness: CWE-79

Which versions are affected by CVE-2022-4217?

It affects 1 product.

Products include Kibokolabs Chained Quiz.

How do I fix CVE-2022-4217?

No fix has been published for CVE-2022-4217 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-4217 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4217 exists.

Other vulnerabilities in prasunsen Chained Quiz

• CVE-2018-14502 SQL injection in n/a Critical 9.8
• CVE-2022-4208 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef Medium 6.1
• CVE-2022-4209 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf Medium 6.1
• CVE-2022-4210 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf Medium 6.1
• CVE-2022-4211 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f4h7-2jxm-q54f.