WHA Puzzle
WHA Puzzle has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WHA Puzzle has a vendor fix available, so running the current release closes it.
All of these findings were reported by thiennv. WHA Puzzle is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-45839WHA Puzzle <= 1.0.9 - Authenticated (Contributor+) Cross-Site Scripting
Read the full analysisVulnerability Records
WHA Puzzle
Author
Oleksandr Chumak
Puzzle is a jigsaw game: a mosaic that has to be assembled from many fragments of various shapes. It is one of the most affordable toys that develop logical thinking, attention, memory and imagination. The plugin adds a “Puzzle” post type. Each puzzle has its own image, grid size (up to 10×10), canvas colour, ghost-image opacity and a custom congratulations message, and is embedded anywhere with the “Puzzle” block in the block editor or the [game-puzzle id="N"] shortcode. Features HTML5 canvas game with drag-and-drop pieces, snapping and a red hint outline. Start / pause, reset, timer and a solved-puzzles counter. Full-screen mode. Separate images for desktop and mobile. Optional front-end upload so visitors can play with their own picture. Completion modal with a custom message and Facebook / Twitter / LinkedIn share links. “Puzzle” block for the block editor with a puzzle picker and preview; existing shortcodes can be converted to the block. Works in sub-directory installs, custom content directories and multisite. Video: https://www.youtube.com/watch?v=Ojja8RrFU58
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C