Descrição
The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation on the hdq_validate_nonce function. This makes it possible for unauthenticated attackers to delete or modify quizzes and questions, create new quizzes, and change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS 4.3EPSS 0.179%Risco 0.44
Ver fonte- Publicação
- 2026-06-27 02:16:29
- Versões afetadas
- >=2.2.0,<2.2.2
- Tipo
- Aplicação web
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N