4.4Media

CVE-2025-24701WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

Bob Chained Quiz Publicada: 2025-01-24 20:24 (hace 1 año)

Descripción

Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through <= 1.3.2.9.

Debilidad (CWE): CWE-918

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Bob	Chained Quiz	≤ 1.3.2.9

Referencias y parches

https://patchstack.com/database/Wordpress/Plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-3… vdb-entry

Puntuación CVSS

4.4Media

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Alta
Privilegios: Altos
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Todas las puntuaciones (2)

cna	CVSS 3.1	4.4Media
audit@patchstack.com	CVSS 3.1	4.4Media

EPSS (probabilidad de explotación en 30 días)

0.34%

superior al 28 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2025-01-23
Publicada2025-01-24 20:24
Llegó a IP-DB2026-10-24 23:58
Última actualización2026-06-17 11:59

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

6.4Media

CVE-2026-18742 hace 45 minutos

Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block

UX-themes Flatsome

The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block in all versions up to, and including, 3.20.12 due to insufficient input sanitization and output escap…

Sin puntuación

CVE-2026-126639 hace 3 horas

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name…

Sin puntuación

CVE-2026-126640 hace 3 horas

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site o…

Sin puntuación

CVE-2026-126697 hace 3 horas

Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Quick Page/Post Redirect Plugin

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which wa…

Sin puntuación

CVE-2026-118182 hace 3 horas

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5…

Sin puntuación

CVE-2026-118183 hace 3 horas

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create …