Vulnerability · Published Nov 17, 2021 · Assigned by WPScan
CVE-2021-24833YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module
Medium 5.4
In plain English
A medium-severity cross-site scripting in YOP Poll from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Affected products (as reported)
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2605368 x_refsource_CONFIRM
- https://www.fortiguard.com/zeroday/FG-VD-21-052 x_refsource_MISC