SQL Injection Vulnerability in WP-Polls Plugin for WordPress

CVE-2024-13426

Summary

The WP-Polls plugin for WordPress contains a vulnerability that enables SQL Injection through COOKIE manipulation. This issue arises from inadequate escaping of user-supplied parameters and poorly prepared SQL queries. Attackers, without needing authentication, can insert additional SQL queries into existing ones. While the results are not visible to the attacker, an appropriately crafted payload may allow for the injection of malicious JavaScript, leading to Stored Cross-Site Scripting risks, thereby compromising the integrity of affected sites.

References