CVE-2026-108494: High severity vulnerability

Q: What must an attacker do to exploit this issue?

The attack vector is network-based and requires no authentication, but it does require user interaction. An attacker would need to cause a user to interact with crafted content that triggers the cross-site scripting flaw.

Q: Who is exposed?

Sites using Chained Quiz version 1.4.1 or earlier are affected according to the available information. Because no privileges are required, unauthenticated attackers may be able to target users who interact with the malicious content.

Published Oct 29, 2026

Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Chained Quiz plugin to a version that resolves this vulnerability.
Fixed in 1.4.2

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attack vector is network-based and requires no authentication, but it does require user interaction. An attacker would need to cause a user to interact with crafted content that triggers the cross-site scripting flaw.

Who is exposed?

Sites using Chained Quiz version 1.4.1 or earlier are affected according to the available information. Because no privileges are required, unauthenticated attackers may be able to target users who interact with the malicious content.

CVE-2026-108494: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed?