WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-41871

7.1HIGH

Key Information:

Vendor
WordPress
Status
Poll Maker
Vendor
CVE Published:
25 September 2023

Summary

The Poll Maker plugin for WordPress versions up to 4.7.0 is susceptible to a reflected cross-site scripting (XSS) vulnerability, allowing attackers to inject malicious scripts into web pages viewed by other users. This security flaw can be exploited by unauthenticated users, potentially leading to the execution of harmful scripts within the context of the affected site. Administrators and users of the Poll Maker plugin should promptly update to a secure version to mitigate this risk.

Affected Version(s)

Poll Maker <= 4.7.0

References

https://patchstack.com/database/vulnerability/poll-maker/...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.