CVE-2024-3600 — Missing Authorization in Poll Maker

CWE-862 — Missing AuthorizationCWE-79 — Cross-site ScriptingCWE-190 — Integer Overflow or Wraparound4 documents4 sources
Severity
6.1MEDIUMNVD
CNA7.2
EPSS
1.1%
top 22.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ays-pro Poll Maker
Timeline
PublishedApr 19
Latest updateFeb 27

Description

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDays-pro/poll_maker< 5.1.9

🔴Vulnerability Details

2
GHSA
GHSA-w4r6-cjx2-64gc: The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the↗2024-04-19
▶
CVEList
Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting↗2024-04-19
▶

📋Vendor Advisories

1
Red Hat
kernel: rtc: tps6594: Fix integer overflow on 32bit systems↗2025-02-27
▶
CVE-2024-3600 — Missing Authorization in Poll Maker | cvebase