Login Request a demo
Medium severity · published Nov 17, 2021
CVE-2021-24833
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as…
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YP
Yop Poll · Yop-poll
before 6.3.1 · source: NVD
Affected product
YP
Yop Poll
Yop-poll
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24833
Patch
https://plugins.trac.wordpress.org/changeset/2605368
Third Party Advisory
https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34
Third Party Advisory
https://www.fortiguard.com/zeroday/FG-VD-21-052
More from Yop Poll
6.1
CVE-2021-24885
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
6.1
CVE-2021-24454
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can…
6.1
CVE-2019-9914
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS
5.4
CVE-2022-0205
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a…
5.4
CVE-2021-24834
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as…