PT-2022-13997 · WordPress · Yop Poll

Name of the Vulnerable Software and Affected Versions: YOP Poll WordPress plugin versions prior to 6.4.3 Description: The issue allows bypassing IP-based limitations to vote in certain situations due to the plugin prioritizing getting a visitor's IP from certain HTTP headers over PHP's REMOTE ADD...

WordPress YOP Poll Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress YOP Poll Plugin versions prior to 6.3.5, which stems...

CVE-2021-24833

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to...

CVE-2021-24885

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24885

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

WordPress YOP Poll Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress YOP Poll Plugin, which stems from a lack of...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress YOP Poll Plugin, which stems from a lack of...

WordPress YOP Poll plugin <= 6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability via Preview Module

Stored Cross-Site Scripting XSS vulnerability via Preview Module discovered by Vishnupriya Ilango in WordPress YOP Poll plugin versions = 6.3.0. Solution Update the WordPress YOP Poll plugin to the latest available version at least 6.3.1...

CVE-2021-24442

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks...

CVE-2021-24442

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks...

WordPress YOP Poll plugin <= 6.2.7 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Toby Jackson in WordPress YOP Poll plugin versions = 6.2.7. Solution Update the WordPress YOP Poll plugin to the latest available version at least 6.2.8...

CVE-2020-24315

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

CVE-2020-24315

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

Design/Logic Flaw

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

CVE-2020-24315

CVE-2020-24315 affects the Vinoj Cardoza WordPress Poll Plugin (versions prior to 37). The root cause is missing input escaping on the pollid POST parameter, allowing an attacker to craft SQL statements that can dump the target database. Impact noted across sources as an SQL injection with potent...

CVE-2020-24315: Improper Neutralization of Special Elements used in an SQL Command

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

PT-2020-15680 · Vinoj Cardoza · Vinoj Cardoza Wordpress Poll Plugin

Name of the Vulnerable Software and Affected Versions: Vinoj Cardoza WordPress Poll Plugin versions prior to v37 Description: The issue allows users to execute SQL statements by crafting specific input, potentially leading to the dumping of the entire target's database. This is due to a lack of...

CVE-2013-1401

Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll...

Sql injection

Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or pollid parameter in a viewPollResults or userlogs action...

Security feature bypass

Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll...