CVE-2026-8995: Exposure of Sensitive Information to an Unauthorized Actor

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 6.3.7. This is due to insufficient access controls on the 'ayspollgetuserinformation' AJAX action, which serializes and returns the...

CVE-2025-13143: Cross-Site Request Forgery (CSRF)

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnectaccountaction function. This makes it possible for...

PT-2025-46784

Name of the Vulnerable Software and Affected Versions The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions through 6.0.7 Description The software is susceptible to a SQL Injection issue due to inadequate input sanitization and query preparation. Specifically,...

CVE-2025-12620: Improper Neutralization of Special Elements used in an SQL Command

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the ‘filterbyauthor’ parameter in all versions up to, and including, 6.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2024-12575: Exposure of Sensitive Information to an Unauthorized Actor

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'aysfinishpoll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information...

PT-2025-25644 · WordPress · The Poll

Name of the Vulnerable Software and Affected Versions: The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress versions up to, and including, 19.9.0 Description: The issue is related to a misconfigured capability check on several functions, allowing authenticated attackers with...

CVE-2025-3880: Incorrect Authorization

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with...

CVE-2024-13602: Improper Neutralization of Input During Web Page Generation

The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12115: Cross-Site Request Forgery (CSRF)

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on the duplicatepoll function. This makes it possible for unauthenticated...

CVE-2024-9874: Improper Neutralization of Special Elements used in an SQL Command

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2024-39904 · WordPress · The Poll Maker – Versus Polls

Name of the Vulnerable Software and Affected Versions: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions up to, and including, 5.4.6 Description: The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the...

PT-2024-39653 · WordPress · The Poll Maker – Versus Polls

Name of the Vulnerable Software and Affected Versions: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions up to, and including, 5.4.6 Description: The issue is related to generic SQL Injection via the order by parameter due to insufficient escaping on the...

CVE-2024-9475: Improper Neutralization of Special Elements used in an SQL Command

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the orderby parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2024-9462: Improper Neutralization of Input During Web Page Generation

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions up to, and including, 5.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-3601: Missing Authorization

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ayspollcreateauthor function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email...

CVE-2024-3600: Missing Authorization

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ayspollmakerquickstart AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes i...

PT-2024-26836

Name of the Vulnerable Software and Affected Versions The Poll Maker – Best WordPress Poll Plugin versions up to, and including, 5.1.8 Description The issue is related to Stored Cross-Site Scripting due to a missing capability check on the ays poll maker quick start AJAX action, as well as...

CVE-2021-24442: Improper Neutralization of Special Elements used in an SQL Command

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks...