CVE-2024-3600

HIGH

Poll Maker WordPress Plugin <= 5.1.8 - Unauthenticated Stored XSS via ays_poll_maker_quick_start

Title source: llm

Description

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071296%40poll-maker&new=3071296%40poll-maker&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/fec015e1-7f64-4917-a242-90bd1135f680?source=cve

Scores

CVSS v3 7.2

EPSS 0.0038

EPSS Percentile 30.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-862

Status published

Products (2)

ays-pro/Poll Maker – Versus Polls, Anonymous Polls, Image Polls < 5.1.8

ays-pro/poll_maker < 5.1.9

Published Apr 19, 2024

Tracked Since Feb 18, 2026