CVE-2021-24442

CRITICALNuclei

Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24442 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 6, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

poll\,_survey\,_questionnaire_and_voting_system

Browse wpdevart / Poll, Survey, Questionnaire and Voting system
CVE List, VulnCheck1.5.3 to < 1.5.3affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordpress Polls Widget < 1.5.3 - SQL InjectionCVSS 9.8

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks

Impact

Unauthenticated attackers can execute SQL injection to manipulate database contents, potentially gaining unauthorized access to all WordPress data including user credentials.

Remediation

Fixed in 1.5.3

WeaknessesCWE-89
Authorsritikchaddha
Template tagstime-based-sqliwpscancvecve2021wpwp-pluginwordpresspolls-widgetsqliwpdevartvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wpdevart:poll\,_survey\,_questionnaire_and_voting_system:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/polls-widget/
FOFA: body=/wp-content/plugins/polls-widget/
https://wpscan.com/vulnerability/7376666e-9b2a-4239-b11f-8544435b444a/ https://nvd.nist.gov/vuln/detail/CVE-2021-24442 https://wordpress.org/plugins/polls-widget/

Source: ProjectDiscovery

References

3