Live › vulnerability › CVE-2026-108494
Chained Quiz WordPress plugin up to 1.4.1 has an unauthenticated cross-site scripting flaw (CVSS 7.1); Patchstack lists 1.4.2 as fixed. Exposed: WordPress sites with the plugin active at 1.4.1 or older; no account is needed, but a visitor or admin must open a crafted link or page. Sites without the plugin or on 1.4.2+ can skip it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Chained Quiz WordPress plugin at version 1.4.1 or earlier are exposed. The sources do not say which quiz pages or inputs are vulnerable, so a site without the plugin installed is not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| chained-quiz | wordpress | <= 1.4.1 | 1.4.2 |
Version: in wp-content/plugins/chained-quiz/chained-quiz.php. 1.4.1 or lower is exposedUpdate Chained Quiz to or later (per Patchstack; not yet confirmed on vendor changelog)
1.4.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-108494")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.