PT-2025-38804 · Unknown · Ays Pro Poll Maker

Abu Hurayra · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57954

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ays Pro Poll Maker versions through 6.0.1

Description Ays Pro Poll Maker is susceptible to a DOM-Based Cross-site Scripting issue due to improper input neutralization during web page generation. This allows for the injection of malicious scripts into web pages. The issue involves a vulnerability where untrusted data is incorporated into the Document Object Model (DOM) without proper sanitization, potentially leading to the execution of arbitrary JavaScript code in the context of the user's browser.

Recommendations Update Ays Pro Poll Maker to a version later than 6.0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57954

Affected Products

Ays Pro Poll Maker

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-57954 · Security Note
• https://twitter.com/CVEnew/status/1970208050922561602 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/poll-maker/vulnerability/wordpress-poll-maker-plugin-6-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/poll-maker/vulnerability/wordpress-poll-maker-plugin-6-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note