Read the docs

Yop-poll

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Yop-poll records in CISA KEV

No Yop-poll vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Yop Poll 6 records LOW Yop-poll 3 records LOW

Records

9 records

TI-2021-06743 CVE-2021-24454 · GHSA-whff-r7hf-mx5w

YOP Poll < 6.2.8 - Stored Cross-Site Scripting

Priority LOW 30

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issu…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01593 Published 2021-07-12 Fixed in 6.2.8 CWE-79
TI-2021-07167 CVE-2021-24885 · GHSA-fr5j-77mg-3779

YOP Poll < 6.1.2 - Reflected Cross-Site Scripting

Priority LOW 29

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2021-10-25 Fixed in 6.1.2 CWE-79
TI-2021-07116 CVE-2021-24834 · GHSA-4rg7-7m6h-7jqr

YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module

Priority LOW 28

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbit…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01532 Published 2021-11-17 Fixed in 6.3.1 CWE-79
TI-2021-07115 CVE-2021-24833 · GHSA-ggxf-x772-3hfw

YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module

Priority LOW 27

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary sc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01124 Published 2021-11-17 Fixed in 6.3.1 CWE-79
TI-2017-01431 CVE-2017-2127 · GHSA-94gp-xpxx-7fc2

Cross-site scripting in YOP Poll

Priority LOW 26

Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00936 Published 2017-04-28 Fixed in 5.8.1 CWE-79
TI-2022-01470 CVE-2022-1600 · GHSA-5q68-9mm8-q9vm

YOP Poll < 6.4.3 - IP Spoofing

Priority LOW 25

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00788 Published 2022-08-01 Fixed in 6.4.3 CWE-639
TI-2022-00142 CVE-2022-0205 · GHSA-gqxv-7446-q28c

YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting

Priority LOW 25

The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00604 Published 2022-03-07 Fixed in 6.3.5 CWE-79
TI-2023-05615 CVE-2023-6109 · GHSA-pgj2-fwxq-v5vr

YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation

Priority LOW 24

The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00373 Published 2023-11-14 No fix listed CWE-362
Open these records in search →