CVE-2021-34635 — Cross-site Scripting in PRO Extensions Poll Maker

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 56.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
AYS PRO Extensions Poll MakerAys-pro Poll Maker
Timeline
PublishedAug 2
Latest updateMay 24

Description

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ays_pro_extensions/poll_maker3.2.8 — 3.2.8

🔴Vulnerability Details

2
GHSA
GHSA-76xq-r882-9hgq: The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-m↗2022-05-24
▶
CVEList
Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting↗2021-08-02
▶
CVE-2021-34635 — Cross-site Scripting | cvebase