CVE-2024-3600: Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ayspollmakerquickstart AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3600?
CVE-2024-3600 is classified as having a high severity due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-3600?
To fix CVE-2024-3600, update the Poll Maker – Best WordPress Poll Plugin to version 5.1.9 or later.
Which versions are affected by CVE-2024-3600?
CVE-2024-3600 affects all versions of the Poll Maker – Best WordPress Poll Plugin up to and including version 5.1.8.
What types of attacks can CVE-2024-3600 enable?
CVE-2024-3600 can enable attackers to perform stored cross-site scripting (XSS) attacks, allowing them to execute malicious scripts in users' browsers.
Is user data at risk due to CVE-2024-3600?
Yes, CVE-2024-3600 puts user data at risk as it can be exploited to inject harmful scripts that may steal sensitive information.