PT-2024-26836 · WordPress · The Poll Maker – Best Wordpress Poll Plugin

Krzysztof Zając · Published 2024-04-18 · Updated 2024-04-19 · CVE-2024-3600

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Poll Maker – Best WordPress Poll Plugin versions up to, and including, 5.1.8

Description The issue is related to Stored Cross-Site Scripting due to a missing capability check on the ays poll maker quick start AJAX action, as well as insufficient escaping and sanitization. This allows unauthenticated attackers to create quizzes and inject malicious web scripts into them, which execute when a user visits the page.

Recommendations For versions up to, and including, 5.1.8, update to a version that includes the necessary capability check and proper escaping and sanitization to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the ays poll maker quick start AJAX action to prevent unauthenticated attackers from exploiting the issue.

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2024-3600

Affected Products

The Poll Maker – Best Wordpress Poll Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-3600 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3600 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/fec015e1-7f64-4917-a242-90bd1135f680?source=cve · Note
• https://twitter.com/CVEnew/status/1781153881143316789 · Twitter Post
• https://t.me/cvenotify/77382 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071296%40poll-maker&new=3071296%40poll-maker&sfp_email=&sfph_mail= · Note