Polls Widget Vulnerabilities

[en] Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.

Affected:

up to 1.7.5

Fixed in:

1.7.5

Disclosed:

Sep 6, 2022

CVE-2022-34656 on NVD →

The Poll, Survey, Questionnaire and Voting system plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to i...

CVSS:

5.5

Affected:

up to 1.7.4

Fixed in:

1.7.5

Disclosed:

Aug 25, 2022

CVE-2022-34656 on NVD →

[en] The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Jul 12, 2021

CVE-2021-24442 on NVD →

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks

CVSS:

9.8

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Jun 22, 2021

CVE-2021-24442 on NVD →

This WordPress Polls Widget plugin is prone to an SQL injection via front_end.php. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Update the plugin.

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Dec 8, 2015