# Chained Quiz

> Create a quiz where the next question depends on the answer to the previous question. Final quiz results depend on the amount of collected points.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:32 UTC.

## Facts (WordPress.org)

- Slug: `chained-quiz`
- Author: Bob
- Version: 1.4.2
- Active installs: 1,000+
- Last update: 2026-10-19 (26 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 8.0
- Tags: exam, questionnaire, quiz, survey, test
- Page: https://wordpress.org/plugins/chained-quiz/

## Checks (against WordPress 7.1.4)

- OK: Updated 26 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Inaccessible ↔ Accessible, Paywalled ↔ Generous, Locked in ↔ Portable, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-10-29 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.4.1). CVE-2026-108494, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c8516ba-9bc9-40ae-989c-6ca23937282d?source=api-prod
- 2025-09-17 MEDIUM: Unauthenticated Insecure Direct Object Reference via Cookie (up to 1.3.5). CVE-2025-10493, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8f6965-1fe3-4f24-bd6b-9026e91bc5db?source=api-prod
- 2025-01-24 MEDIUM: Authenticated (Admin+) Server-Side Request Forgery (up to 1.3.2.9). CVE-2025-24701, https://www.wordfence.com/threat-intel/vulnerabilities/id/49023c6b-a236-42c1-ab24-072fa4a72967?source=api-prod
- 2024-07-09 MEDIUM: Missing Authorization (up to 1.3.2.8). CVE-2024-37921, https://www.wordfence.com/threat-intel/vulnerabilities/id/69bc3b17-87fd-4e69-b769-85bbf13b214e?source=api-prod
- 2024-06-28 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 1.3.2.8). CVE-2024-37446, https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ed1cbd-1dd0-4996-8255-91a9131934c0?source=api-prod
- 2023-02-06 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.3.2.5). CVE-2023-25027, https://www.wordfence.com/threat-intel/vulnerabilities/id/68ec28e8-345c-4017-ab0d-04ac4facd60c?source=api-prod
- 2022-12-02 MEDIUM: Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying (up to 1.3.2.4). CVE-2022-4218, https://www.wordfence.com/threat-intel/vulnerabilities/id/49333c6b-58f6-4d5a-a605-46484160175a?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via datef (up to 1.3.2). CVE-2022-4208, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a316c0a-452a-4205-b79b-8bd911016ab2?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via emailf (up to 1.3.2). CVE-2022-4211, https://www.wordfence.com/threat-intel/vulnerabilities/id/6781b7b7-c11a-4328-8d14-ffafc2ccb127?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via ip (up to 1.3.2.3). CVE-2022-4214, https://www.wordfence.com/threat-intel/vulnerabilities/id/9145ce0d-311c-4be1-be15-7e1791c17860?source=api-prod
- 2022-12-02 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key (up to 1.3.2.2). CVE-2022-4217, https://www.wordfence.com/threat-intel/vulnerabilities/id/93a07027-1068-41fa-bd6b-74ccc0441a16?source=api-prod
- 2022-12-02 MEDIUM: Cross-Site Request Forgery to Question Deletion (up to 1.3.2.4). CVE-2022-4220, https://www.wordfence.com/threat-intel/vulnerabilities/id/966a3a33-3d22-4671-8893-7a64ff838f39?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via ipf (up to 1.3.2). CVE-2022-4212, https://www.wordfence.com/threat-intel/vulnerabilities/id/99555021-68f4-4395-978d-ff1bbae9ebd4?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via date (up to 1.3.2.3). CVE-2022-4215, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bb8fea-8b2c-42da-a224-0719a584d92b?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via pointsf (up to 1.3.2). CVE-2022-4209, https://www.wordfence.com/threat-intel/vulnerabilities/id/b708b72f-d906-47c9-9bf7-a9397956db3d?source=api-prod
- 2022-12-02 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID (up to 1.3.2.2). CVE-2022-4216, https://www.wordfence.com/threat-intel/vulnerabilities/id/c031d2a4-d009-4422-a751-b8476e15a808?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via dnf (up to 1.3.2). CVE-2022-4210, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a49064-ad48-410e-9b32-f94109830ccf?source=api-prod
- 2022-12-02 MEDIUM: Cross-Site Request Forgery to Submitted Response Deletion (up to 1.3.2.4). CVE-2022-4219, https://www.wordfence.com/threat-intel/vulnerabilities/id/cf96887c-6e0d-43d9-a3f2-88981adb4c98?source=api-prod
- 2022-12-02 MEDIUM: Reflected Cross-Site Scripting via dn (up to 1.3.2.2). CVE-2022-4213, https://www.wordfence.com/threat-intel/vulnerabilities/id/d46edcfe-ab6b-4966-9d85-40a2e2ee3d44?source=api-prod
- 2021-09-07 MEDIUM: Cross-Site Scripting (before 1.2.7.2). CVE-2021-24690, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e05142e-04a3-483e-a4af-035df3609b9d?source=api-prod
- 2020-02-21 MEDIUM: Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting (up to 1.1.9). WF-b3bae191-9395-481c-93bf-b17cf5f87271, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3bae191-9395-481c-93bf-b17cf5f87271?source=api-prod
- 2020-01-16 MEDIUM: Reflected Cross-Site Scripting (before 1.1.8.2). CVE-2020-7104, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d553ff1-9f05-47c2-83be-66dba318e63e?source=api-prod
- 2018-08-16 CRITICAL: Unauthenticated SQL Injection (before 1.0.9). CVE-2018-14502, https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ef0c41-e498-4de6-a86a-d23f65a7a824?source=api-prod
- 2017-01-12 MEDIUM: Cross-Site Scripting (before 1.0). CVE-2016-10892, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8dc895-8caa-4a37-80f0-3a5516c25dfe?source=api-prod
- 2016-12-21 MEDIUM: Cross-Site Scripting (up to 0.9.8). WF-76a4dbcd-b3f3-48e9-8175-c701837ac2ae, https://www.wordfence.com/threat-intel/vulnerabilities/id/76a4dbcd-b3f3-48e9-8175-c701837ac2ae?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=chained-quiz · HTML: https://todaywp.com/plugins/chained-quiz