CVE-2021-24454 YOP Poll < 6.2.8 - Stored Cross-Site Scripting

What is CVE-2021-24454?

CVE-2021-24454 is a medium-severity cross-site scripting vulnerability in Unknown YOP Poll, published on 12 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.

Weakness: CWE-79

Which versions are affected by CVE-2021-24454?

It affects 1 product.

Products include Yop-Poll Yop Poll.

How do I fix CVE-2021-24454?

No fix has been published for CVE-2021-24454 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24454 being exploited?

There is no known exploitation of CVE-2021-24454 in the wild and no public exploit code.

Other vulnerabilities in Unknown YOP Poll

• CVE-2021-24833 YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module Medium 5.4
• CVE-2021-24834 YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module Medium 5.4
• CVE-2017-2127 Cross-site scripting in YOP Poll Medium 5.4
• CVE-2023-6109 YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation Medium 5.3
• CVE-2022-1600 YOP Poll < 6.4.3 - IP Spoofing Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-whff-r7hf-mx5w.