Cross-Site Scripting Vulnerability in Codepeople CP Polls Plugin
CVE-2025-50025

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Cp Polls
Vendor
CVE Published:
20 June 2025

What is CVE-2025-50025?

A vulnerability exists in the Codepeople CP Polls plugin that allows attackers to inject malicious scripts via web page generation. This flaw, categorized as a Stored XSS issue, affects users by executing arbitrary JavaScript code in their browsers when they interact with the compromised polls. The issue affects all versions of CP Polls up to 1.0.81, posing a significant threat to user data and site integrity.

Affected Version(s)

CP Polls <= 1.0.81

References

https://patchstack.com/database/wordpress/plugin/cp-polls...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.