The Chained Quiz plugin for WordPress contains an unauthenticated XSS flaw that allows an attacker to inject arbitrary JavaScript into a page that users view. The vulnerability is classified as CWE‑79, indicating that user‑supplied data is reflected without proper sanitization or encoding. An attacker can construct a request that includes malicious script; when a victim visits the affected page the script runs in the victim’s browser with the same privileges as that user, enabling cookie theft, phishing, or defacement.

WordPress sites that use the Chained Quiz plugin version 1.4.1 or earlier are affected. This plugin, provided by the vendor Bob under the product name Chained Quiz, has had the issue fixed in version 1.4.2 and later. No other WordPress core components or plugins are impacted by this specific flaw.

The CVSS score of 7.1 classifies the vulnerability as high‑severity, and because authentication is not required, exploitation is straightforward for anyone who can send a crafted request to the site. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the lack of an authentication requirement makes the threat real. The vulnerability is not listed in the CISA KEV catalog, yet its severity and ease of exploitation warrant immediate corrective action.