CVE-2026-13422

Name of the Vulnerable Software and Affected Versions HD Quiz versions 2.2.0 through 2.2.1

Description The HD Quiz plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the hdq validate nonce() function fails to properly validate nonces, which are unique tokens used to prevent unauthorized requests. Consequently, unauthenticated attackers can trick a site administrator into clicking a malicious link to execute forged requests. This allows the attacker to create new quizzes, modify or delete existing quizzes and questions, and alter plugin settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.