EUVD-2025-210505
GHSA-w89g-g5jf-9hr9
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Admin credentials required (PR:H); scope changes to visitor browsers (S:C); no meaningful availability impact from XSS injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
AnalysisAI
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
WP-Polls is a WordPress polling plugin authored by Lester Chan, identified by CPE cpe:2.3:a:lester_chan:wp-polls:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical cross-site scripting weakness class, indicating that administrator-supplied input - likely poll question text, answer options, or plugin settings - is insufficiently sanitized or escaped before being rendered in HTML contexts served to site visitors. The S:C (Scope Changed) metric in the CVSS vector confirms that the vulnerability bridges two security boundaries: the WordPress admin panel where the payload is injected, and the public-facing front-end where it executes in visitor browsers. This is characteristic of stored XSS in a WordPress plugin's admin UI, where output escaping is missing or incomplete in template rendering paths.
RemediationAI
Upgrade the WP-Polls plugin to the first release beyond version 2.77.3, as directed by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-polls/vulnerability/wordpress-wp-polls-plugin-2-77-3-cross-site-scripting-xss-vulnerability. An exact patched version number was not independently confirmed in the available intelligence - verify the current stable release in the WordPress plugin repository before updating. If an immediate upgrade is not possible, restrict WordPress administrator access to trusted accounts only and enforce strong authentication (MFA) on all admin accounts to reduce the likelihood that an attacker can reach the injection point. Additionally, deploying a web application firewall with XSS filtering rules (e.g., Patchstack's virtual patching, Wordfence, or Cloudflare WAF) can block attempted payload delivery as a compensating control, though this does not eliminate the underlying flaw. Note that restricting the admin panel via IP allowlist is an effective mitigation with low side-effect risk for sites with fixed administrator locations.
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMO
Auth. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today