Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSS
Priority MEDIUM 56CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed Poll, Survey & Quiz Maker Plugin by Opinion Stage (Assaf Parag): 19.6.25
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Assaf Parag | Poll, Survey & Quiz Maker Plugin by Opinion Stage | before 19.6.25 | 19.6.25 | Patch available | CNA |
- Poll, Survey & Quiz Maker Plugin by Opinion Stage VendorAssaf Parag Affected before 19.6.25 Fixed in 19.6.25 Patch available CNA
Remediation
- Fix · CNA Poll, Survey & Quiz Maker Plugin by Opinion Stage (Assaf Parag) Fixed in 19.6.25
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25297
- 2026-10-03 Alias added: GHSA-5ff7-3c96-mv34
References
Exploit 2
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-polls-by-opinionstage/poll-survey-quiz-maker-plugin-by-opinion-stage-19625-unauthenticated-stored-cross-site-scripting
- https://web.archive.org/web/20191020011448/https://www.pluginvulnerabilities.com/2019/09/16/hackers-may-already-be-targeting-this-persistent-xss-vulnerability-in-poll-survey-form-quiz-maker-by-opinionstage/
Patch 2
Sources
- CVE-2019-25297 · CVE Program
- CVE-2019-25297 · NVD
- FIRST EPSS
- GHSA-5ff7-3c96-mv34 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences