PT-2025-11380

Name of the Vulnerable Software and Affected Versions The Poll Maker WordPress plugin versions prior to 5.5.4 Description The issue concerns the Poll Maker WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

CVE-2024-9475

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the orderby parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2022-1456 Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting

The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfilteredhtml is disallowed...

PT-2022-13900

Name of the Vulnerable Software and Affected Versions Poll Maker WordPress plugin versions prior to 4.0.2 Description The issue allows high privilege users, such as admins, to perform Store Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin's failure to...

CVE-2021-24651: Improper Neutralization of Special Elements used in an SQL Command

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the aysfinishpoll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash...

Sql injection

The getpollcategories, getpolls and getreports functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

PT-2021-16006

Name of the Vulnerable Software and Affected Versions Poll Maker WordPress plugin versions prior to 3.2.1 Description The issue concerns the get poll categories, get polls, and get reports functions, which did not properly validate the orderby parameter before using it in SQL statements. This...

CVE-2021-34635: Improper Neutralization of Input During Web Page Generation

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8...

PT-2021-20603

Name of the Vulnerable Software and Affected Versions: Poll Maker WordPress plugin versions up to and including 3.2.8 Description: The issue allows attackers to inject arbitrary web scripts via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file, enabling...