CVE-2026-13422 – HD Quiz 2.2.0 – 2.2.1 – Cross-Site Request Forgery via Multiple AJAX Handlers

CVE ID :CVE-2026-13422

Published : June 27, 2026, 1:27 a.m. | 2 hours, 17 minutes ago

Description :The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation on the hdq_validate_nonce function. This makes it possible for unauthenticated attackers to delete or modify quizzes and questions, create new quizzes, and change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…