Wp Polls
Monthly
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required.
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required.
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.