Read the docs

Yop-poll

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Yop-poll records in CISA KEV

No Yop-poll vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Yop Poll 6 records LOW Yop-poll 3 records LOW

Records

6 records in Yop Poll · all components

TI-2021-06743 CVE-2021-24454 · GHSA-whff-r7hf-mx5w

YOP Poll < 6.2.8 - Stored Cross-Site Scripting

Priority LOW 30

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issu…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01593 Published 2021-07-12 Fixed in 6.2.8 CWE-79
TI-2021-07116 CVE-2021-24834 · GHSA-4rg7-7m6h-7jqr

YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module

Priority LOW 28

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbit…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01532 Published 2021-11-17 Fixed in 6.3.1 CWE-79
TI-2021-07115 CVE-2021-24833 · GHSA-ggxf-x772-3hfw

YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module

Priority LOW 27

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary sc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01124 Published 2021-11-17 Fixed in 6.3.1 CWE-79
TI-2017-01431 CVE-2017-2127 · GHSA-94gp-xpxx-7fc2

Cross-site scripting in YOP Poll

Priority LOW 26

Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00936 Published 2017-04-28 Fixed in 5.8.1 CWE-79
TI-2022-01470 CVE-2022-1600 · GHSA-5q68-9mm8-q9vm

YOP Poll < 6.4.3 - IP Spoofing

Priority LOW 25

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00788 Published 2022-08-01 Fixed in 6.4.3 CWE-639
TI-2023-05615 CVE-2023-6109 · GHSA-pgj2-fwxq-v5vr

YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation

Priority LOW 24

The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00373 Published 2023-11-14 No fix listed CWE-362
Open these records in search →