PT-2021-7522 · WordPress · Yop Poll

Vishnupriya Ilango · Published 2021-07-14 · Updated 2021-11-18 · CVE-2021-24834

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 6.3.1

Description The issue is related to a stored Cross-Site Scripting vulnerability in the Create Poll - Options module of the YOP Poll WordPress plugin. This vulnerability exists due to insufficient validation of custom label parameters, specifically the vote button label, results link label, and back to vote caption label. This allows a user with a role as low as author to execute arbitrary script code within the context of the application, potentially leading to remote exploitation.

Recommendations For versions prior to 6.3.1, update to version 6.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Create Poll - Options module or disabling the execution of custom label parameters until a patch is applied. Avoid using the parameters vote button label, results link label, and back to vote caption label in the affected module until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-07237

CVE-2021-24834

Affected Products

Yop Poll

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-24834 · Security Note
• https://plugins.trac.wordpress.org/changeset/2605368 · Patch
• https://bdu.fstec.ru/vul/2022-07237 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24834 · Vendor Advisory
• https://fortiguard.com/zeroday/FG-VD-21-053 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24834 · Note
• https://wordpress.org/plugins/yop-poll/#developers · Note
• https://plugins.trac.wordpress.org/browser/yop-poll/trunk/yop_poll.php?rev=2605368 · Note
• https://wpscan.com/vulnerability/72f58b14-e5cb-4f1c-a16f-621238c6ebbf · Note