---
id: "CVE-2026-108494"
kind: "vulnerability"
aliases: ["CVE-2026-108494"]
title: "Chained Quiz WordPress plugin: unauthenticated XSS through versions 1.4.1"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "chained-quiz", "fixed": ["1.4.2"], "affected": "<= 1.4.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["chained-quiz", "package", "unauthenticated", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T16:17:55+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:40:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108494", "first_seen_at": "2026-10-29T16:25:55+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:40:24+00:00"}]
---

# Chained Quiz WordPress plugin: unauthenticated XSS through versions 1.4.1

Chained Quiz WordPress plugin up to 1.4.1 has an unauthenticated cross-site scripting flaw (CVSS 7.1); Patchstack lists 1.4.2 as fixed. Exposed: WordPress sites with the plugin active at 1.4.1 or older; no account is needed, but a visitor or admin must open a crafted link or page. Sites without the plugin or on 1.4.2+ can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:chained-quiz affected <= 1.4.1 fixed 1.4.2

## How to check

WordPress admin > Plugins: check Chained Quiz version; or read 'Version:' in wp-content/plugins/chained-quiz/chained-quiz.php. 1.4.1 or lower is exposed. WP-CLI: wp plugin get chained-quiz --field=version

## Fix

Update Chained Quiz to 1.4.2 or later (per Patchstack; not yet confirmed on vendor changelog)

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108494
- 2026-10-29T16:40:24+00:00 analyst — Patchstack (third party, not vendor) lists <=1.4.1 vulnerable, fixed 1.4.2, unauthenticated XSS, CVSS 7.1, reported 11 Sep 2026, published 13 Oct. Vulnerable parameter not disclosed. wordpress.org page has no changelog for 1.4.2 so nothing verified; NVD page returned empty. No exploitation or PoC found; no social search done.

## Documents

- [advisory] Patchstack: Chained Quiz <= 1.4.1 XSS https://patchstack.com/database/wordpress/plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-4-1-cross-site-scripting-xss-vulnerability
- [mentions] Chained Quiz plugin page (wordpress.org) https://wordpress.org/plugins/chained-quiz/

## From the sources

Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_