Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Chained Quiz Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 24 vulnerability records associated with Chained Quiz, published between 2016 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

24Total records
1Critical
0High
23Medium
0Low
0Informational
24Patched records
0Currently marked unpatched
2016-12-21First disclosure
2025-09-17Latest disclosure
22 of 24CVE coverage

Use this history

Check and watch Chained Quiz.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed versionWatch Chained Quiz

Year-by-Year Timeline

YearRecordsRelative volume
201611 records
201711 records
201811 records
202022 records
202111 records
20221313 records
202311 records
202422 records
202522 records

Severity Breakdown

SeverityRecordsShare
Critical14.2%
Medium2395.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

18 records75%

First: 2016. Latest: 2024.

CSRF

3 records12.5%

First: 2022. Latest: 2022.

SQL Injection

1 record4.2%

First: 2018. Latest: 2018.

Other

1 record4.2%

First: 2025. Latest: 2025.

Missing Authorization

1 record4.2%

First: 2025. Latest: 2025.

Patch Status

Patched
24
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.3.6
  • 1.3.3
  • 1.3.2.9
  • 1.3.2.6
  • 1.3.2.3
  • 1.3.2.4
  • 1.3.2.1
  • 1.3.2.5
  • 1.2.7.2
  • 1.1.9.1
  • 1.1.8.2
  • 1.0.9
  • 1.0
  • 0.9.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.3.5Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via CookieSeptember 17, 20251.3.6Medium
*-1.3.2.9Chained Quiz <= 1.3.2.9 - Authenticated (Admin+) Server-Side Request ForgeryJanuary 24, 20251.3.3Medium
*-1.3.2.8Chained Quiz <= 1.3.2.8 - Missing AuthorizationJuly 9, 20241.3.2.9Medium
*-1.3.2.8Chained Quiz <= 1.3.2.8 - Authenticated (Administrator+) Stored Cross-Site ScriptingJune 28, 20241.3.2.9Medium
*-1.3.2.5Chained Quiz <= 1.3.2.5 - Authenticated (Admin+) Stored Cross-Site ScriptingFebruary 6, 20231.3.2.6Medium
*-1.3.2.2Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dnDecember 2, 20221.3.2.3Medium
*-1.3.2.4Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response DeletionDecember 2, 20221.3.2.5Medium
*-1.3.2Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfDecember 2, 20221.3.2.1Medium
*-1.3.2.2Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App IDDecember 2, 20221.3.2.3Medium
*-1.3.2Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfDecember 2, 20221.3.2.1Medium
*-1.3.2.3Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via dateDecember 2, 20221.3.2.4Medium
*-1.3.2Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfDecember 2, 20221.3.2.1Medium
*-1.3.2.4Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question DeletionDecember 2, 20221.3.2.5Medium
*-1.3.2.2Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API KeyDecember 2, 20221.3.2.3Medium
*-1.3.2.3Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ipDecember 2, 20221.3.2.4Medium
*-1.3.2Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfDecember 2, 20221.3.2.1Medium
*-1.3.2Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefDecember 2, 20221.3.2.1Medium
*-1.3.2.4Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and CopyingDecember 2, 20221.3.2.5Medium
[*, 1.2.7.2)Chained Quiz < 1.2.7.2 - Cross-Site ScriptingSeptember 7, 20211.2.7.2Medium
*-1.1.9Chained Quiz <= 1.1.9 -Stored Cross-Site ScriptingFebruary 21, 20201.1.9.1Medium
[*, 1.1.8.2)Chained Quiz <= 1.1.8.1 - Reflected Cross-Site ScriptingJanuary 16, 20201.1.8.2Medium
[*, 1.0.9)Chained Quiz <= 1.0.8.2 - Unauthenticated SQL InjectionAugust 16, 20181.0.9Critical
[*, 1.0)Chained Quiz Plugin < 1.0 - Cross-Site ScriptingJanuary 12, 20171.0Medium
*-0.9.8Chained Quiz <= 0.9.8 - Cross-Site ScriptingDecember 21, 20160.9.9Medium

Selected source records

Latest Records

MediumCVE-2025-10493

Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

Published: September 17, 2025

Affected versions
*-1.3.5
Patched versions
1.3.6
Original Wordfence record
MediumCVE-2025-24701

Chained Quiz <= 1.3.2.9 - Authenticated (Admin+) Server-Side Request Forgery

Published: January 24, 2025

Affected versions
*-1.3.2.9
Patched versions
1.3.3
Original Wordfence record
MediumCVE-2024-37921

Chained Quiz <= 1.3.2.8 - Missing Authorization

Published: July 9, 2024

Affected versions
*-1.3.2.8
Patched versions
1.3.2.9
Original Wordfence record
MediumCVE-2024-37446

Chained Quiz <= 1.3.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: June 28, 2024

Affected versions
*-1.3.2.8
Patched versions
1.3.2.9
Original Wordfence record
MediumCVE-2023-25027

Chained Quiz <= 1.3.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: February 6, 2023

Affected versions
*-1.3.2.5
Patched versions
1.3.2.6
Original Wordfence record
MediumCVE-2022-4218

Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying

Published: December 2, 2022

Affected versions
*-1.3.2.4
Patched versions
1.3.2.5
Original Wordfence record
MediumCVE-2022-4208

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef

Published: December 2, 2022

Affected versions
*-1.3.2
Patched versions
1.3.2.1
Original Wordfence record
MediumCVE-2022-4211

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf

Published: December 2, 2022

Affected versions
*-1.3.2
Patched versions
1.3.2.1
Original Wordfence record

Highest-Severity Records

CriticalCVE-2018-14502

Chained Quiz <= 1.0.8.2 - Unauthenticated SQL Injection

Published: August 16, 2018

Affected versions
[*, 1.0.9)
Patched versions
1.0.9
Original Wordfence record
Medium

Chained Quiz <= 0.9.8 - Cross-Site Scripting

Published: December 21, 2016

Affected versions
*-0.9.8
Patched versions
0.9.9
Original Wordfence record
Medium

Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting

Published: February 21, 2020

Affected versions
*-1.1.9
Patched versions
1.1.9.1
Original Wordfence record
MediumCVE-2022-4208

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef

Published: December 2, 2022

Affected versions
*-1.3.2
Patched versions
1.3.2.1
Original Wordfence record
MediumCVE-2022-4211

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf

Published: December 2, 2022

Affected versions
*-1.3.2
Patched versions
1.3.2.1
Original Wordfence record
MediumCVE-2020-7104

Chained Quiz <= 1.1.8.1 - Reflected Cross-Site Scripting

Published: January 16, 2020

Affected versions
[*, 1.1.8.2)
Patched versions
1.1.8.2
Original Wordfence record
MediumCVE-2022-4214

Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip

Published: December 2, 2022

Affected versions
*-1.3.2.3
Patched versions
1.3.2.4
Original Wordfence record
MediumCVE-2022-4212

Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf

Published: December 2, 2022

Affected versions
*-1.3.2
Patched versions
1.3.2.1
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory