Vulnerability · Published Jul 12, 2021 · Assigned by WPScan

CVE-2021-24454YOP Poll < 6.2.8 - Stored Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity cross-site scripting in YOP Poll from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.6%top 24.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.

Affected products (as reported)

Vendor	Product	Versions
Unknown	YOP Poll	6.2.8 – before 6.2.8

Weakness: CWE-79

References

https://wpscan.com/vulnerability/48ade7a5-5abb-4267-b9b6-13e31e1b3e91 x_refsource_CONFIRM
https://www.in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss/ x_refsource_MISC