plugin
23 known security issues reported for the Cp Polls WordPress plugin. Most recent disclosed Jun 15, 2026.
Running Cp Polls on your site? Check whether your installed version is affected.
Scan your site freeThe Polls CP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request gra...
The Polls CP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls allows Stored XSS. This issue affects CP Polls: from n/a through 1.0.81.
The CP Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.81 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that...
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople CP Polls allows Reflected XSS.This issue affects CP Polls: from n/a through 1.0.74.
The CP Polls plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.74 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...
The Polls CP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.76 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitra...
The Polls CP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.76 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitra...
[en] Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP Polls: from n/a through 1.0.71.
[en] : Improper Control of Interaction Frequency vulnerability in CodePeople CP Polls allows Flooding.This issue affects CP Polls: from n/a through 1.0.71.
The Polls CP plugin for WordPress is vulnerable to content injection in all versions up to, and including, 1.0.71. This is due to insufficient validation on poll answers. This makes it possible for unauthenticated attackers to inject arbitrary content.
The Polls CP plugin for WordPress is vulnerable to Poll Limit Bypass in all versions up to, and including, 1.0.71. This is due to insufficient controls on on the voting system. This makes it possible for unauthenticated attackers to vote multiple times.
[en] A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1...
[en] The cp-polls plugin before 1.0.5 for WordPress has XSS.
[en] The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
There are some multiple vulnerabilities in this plugin, such as XSS, CSRF and file download issue. Because of these vulnerabilities, an attacker can inject malicious payload into a votation, inject malicious HTML or JavaScript codes or attack an administrator. Update the plugin.
The cp-polls plugin before 1.0.5 for WordPress has XSS via the 'name' parameter.
The Polls CP plugin for WordPress is vulnerable to SQL Injection via the 'lu' parameter in all versions up to, and including, 1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append addi...
The Polls CP plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
The Polls CP WordPress plugin was affected by a Multiple XSS Vulnerabilities security vulnerability.
The Polls CP WordPress plugin was affected by a Multiple CSRF Vulnerabilities security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free