CVE-2024-8851: Polls CP <= 1.0.75 - Admin+ Stored Cross-Site Scripting
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multi site setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8851?
CVE-2024-8851 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-8851?
To fix CVE-2024-8851, upgrade the Polls CP WordPress plugin to version 1.0.77 or later.
Who is affected by CVE-2024-8851?
CVE-2024-8851 affects users of the Polls CP WordPress plugin versions prior to 1.0.77, particularly high privilege users such as administrators.
What type of attack can CVE-2024-8851 facilitate?
CVE-2024-8851 can facilitate Stored Cross-Site Scripting (XSS) attacks by allowing the injection of malicious scripts.
Do I need to take action if I am using version 1.0.77 or later of the Polls CP plugin?
If you are using version 1.0.77 or later of the Polls CP plugin, you are not affected by CVE-2024-8851 and no action is needed.