12 Jan

Vulnerability Details: Persistent Cross-Site Scripting (XSS) Vulnerability in Chained Quiz

This Vulnerability Details post about a vulnerability in the plugin Chained Quiz provides the details of a vulnerability we didn't discover and access to it is limited to customers of our service, unlike the posts on vulnerabilities we have discovered, which are freely available and give you an idea of what information is provided in the details posts as well.

For existing customers, please log in to your account to view the rest of the post.

If you are not currently a customer, you can sign up here. There are a lot of other reason that you will want to sign up beyond access to posts like this one, including that you would have already been warned about this vulnerability if your website was vulnerable due to it.

If you are a WordPress plugin security researcher please contact us to get free access to all of our Vulnerability Details posts.

2 thoughts on “Vulnerability Details: Persistent Cross-Site Scripting (XSS) Vulnerability in Chained Quiz

  1. “Any available cookies will be shown in alert box on that page.”

    This is simply not true. The HTML is shown as HTML on the page because it is escaped. The plugin MUST allow all kind of input from users because it can be used to examine HTML knowledge.

    • Prior to what you are quoting we noted the vulnerability was fixed by escaping the output. The proof of concept you are quoting shows how the vulnerability would be exploited in prior versions, before the escaping was done, so that seems to be what is confusing you about this.

Leave a Reply

Your email address will not be published. Required fields are marked *