Executive brief
CP Polls is a WordPress plugin used to create and manage interactive polls on websites. A security flaw in version 1.0.8 allows attackers to inject malicious scripts into the website through the plugin's file upload and settings features. If exploited, this could allow an attacker to hijack user sessions, redirect visitors to malicious sites, or deface the website's content.
Technical details
WordPress CP Polls 1.0.8 is vulnerable to persistent Cross-Site Scripting (XSS) due to improper sanitization of user-supplied input in its file upload functionality and poll configuration settings. Attackers can upload files or submit poll data containing malicious JavaScript payloads, such as event handlers (e.g., 'onerror'), which are then stored on the server. When other users, including administrators, view the affected poll or uploaded content, the script executes in their browser context. Additionally, the plugin lacks CSRF protection on its settings page, allowing an attacker to perform these injections by tricking an authenticated administrator into clicking a malicious link. This can lead to full session hijacking or unauthorized administrative actions.
Affected products
- CodePeople CP Polls 1.0.8 and earlier
Timeline
- 2016-02-22: disclosed: Initial discovery and exploit documentation by researcher
- 2016-03-01: other: Exploit published on Exploit-DB
- 2026-06-15: advisory: CVE record published and NVD dataset updated