PT-2021-15980 · WordPress · Yop Poll

Toby Jackson · Published 2021-07-12 · Updated 2021-07-15 · CVE-2021-24454

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YOP Poll WordPress plugin versions prior to 6.2.8

Description The issue arises when a poll is created with specific options, leading to Stored Cross-Site Scripting issues. This occurs because the 'Other' answer is not sanitized before being output on the page. The execution of the XSS payload depends on the 'Show results' option, which could be before or after sending the vote.

Recommendations For YOP Poll WordPress plugin versions prior to 6.2.8, update to version 6.2.8 or later to resolve the issue. As a temporary workaround, consider disabling the 'Allow other answers' and 'Display other answers in the result list' options to minimize the risk of exploitation. Restrict access to polls with the 'Show results' option enabled until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24454

Affected Products

Yop Poll

References · 4

• 🔥 https://wpscan.com/vulnerability/48ade7a5-5abb-4267-b9b6-13e31e1b3e91 · Exploit
• 🔥 https://in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss · Exploit
• https://osv.dev/vulnerability/CVE-2021-24454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24454 · Security Note