{"id":"CVE-2026-108494","kind":"vulnerability","aliases":["CVE-2026-108494"],"related":[],"title":"Chained Quiz WordPress plugin: unauthenticated XSS through versions 1.4.1","description":"Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.","summary":"Chained Quiz WordPress plugin up to 1.4.1 has an unauthenticated cross-site scripting flaw (CVSS 7.1); Patchstack lists 1.4.2 as fixed. Exposed: WordPress sites with the plugin active at 1.4.1 or older; no account is needed, but a visitor or admin must open a crafted link or page. Sites without the plugin or on 1.4.2+ can skip it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chained-quiz","fixed":["1.4.2"],"affected":"<= 1.4.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["chained-quiz","package","unauthenticated","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: check Chained Quiz version; or read 'Version:' in wp-content/plugins/chained-quiz/chained-quiz.php. 1.4.1 or lower is exposed. WP-CLI: wp plugin get chained-quiz --field=version","fix":"Update Chained Quiz to 1.4.2 or later (per Patchstack; not yet confirmed on vendor changelog)","status":"open","published_at":"2026-10-29T16:17:55+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:30:04+00:00","updated_at":"2026-10-29T16:40:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:30:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chained Quiz WordPress plugin: unauthenticated XSS through versions 1.4.1","impact":"medium","summary":"The Chained Quiz WordPress plugin, versions up to and including 1.4.1, has a cross-site scripting flaw reachable without logging in. An attacker can inject script that runs in a visitor's browser on the affected site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","chained-quiz"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Check the NVD entry and the WordPress plugin repository for the vulnerable parameter and a patched version.","how_to_check":"- Check the installed version of Chained Quiz in the WordPress admin plugin list, or inspect the plugin's main file header for `Version:`\n- Treat any version at or below `1.4.1` as exposed\n- Sources do not say which pages or inputs are vulnerable","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Chained Quiz WordPress plugin at version 1.4.1 or earlier are exposed. The sources do not say which quiz pages or inputs are vulnerable, so a site without the plugin installed is not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4068,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the WordPress plugin repository for the vulnerable parameter and a patched version.","search":"'-108494':12A,15A '-2026':11A,14A '1.4.1':9A,35B,59B,95C '1.4.2':48B,84B '7.1':45B 'account':63B 'activ':57B 'admin':70B 'chain':1A,20B,29B,93C 'chained':17A 'chained-quiz':16A,19B 'craft':74B 'cross':40B,88C 'cross-sit':39B 'cve':10A,13A 'cvss':44B 'expos':51B 'fix':50B 'flaw':43B 'link':75B 'list':47B 'must':71B 'need':65B 'older':61B 'open':72B 'packag':22B 'page':77B 'patchstack':46B 'plugin':4A,27B,32B,56B,81B 'quiz':2A,18A,21B,30B,94C 'script':42B,90C 'site':41B,53B,78B,89C 'skip':86B 'unauthent':5A,23B,38B,87C 'version':8A,96C 'visitor':68B 'without':79B 'wordpress':3A,24B,26B,31B,52B 'wordpress-plugin':25B 'xss':6A,28B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Chained Quiz WordPress plugin at version 1.4.1 or earlier are exposed. The sources do not say which quiz pages or inputs are vulnerable, so a site without the plugin installed is not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108494","severity":null,"published_at":"2026-10-29T16:17:55+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108494:1083","url":null,"severity":null,"published_at":"2026-10-29T16:40:24+00:00","modified_at":"2026-10-29T16:40:24+00:00","first_seen_at":"2026-10-29T16:40:24+00:00","fetched_at":"2026-10-29T16:40:24+00:00","note":"Patchstack (third party, not vendor) lists <=1.4.1 vulnerable, fixed 1.4.2, unauthenticated XSS, CVSS 7.1, reported 11 Sep 2026, published 13 Oct. Vulnerable parameter not disclosed. wordpress.org page has no changelog for 1.4.2 so nothing verified; NVD page returned empty. No exploitation or PoC found; no social search done."}],"documents":[{"id":17849,"url":"https://patchstack.com/database/wordpress/plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-4-1-cross-site-scripting-xss-vulnerability","title":"Patchstack: Chained Quiz <= 1.4.1 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17850,"url":"https://wordpress.org/plugins/chained-quiz/","title":"Chained Quiz plugin page (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}