Executive brief
PHP Poll Script is a tool used to create and embed online polls into websites. A security vulnerability in this script allows an attacker to execute malicious code in a user's browser if the user clicks on a specially crafted link. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in PHP Jabbers PHP Poll Script versions prior to 4.1. The application fails to properly neutralize user-supplied input before including it in web page generation. An unauthenticated remote attacker can exploit this by tricking a user into visiting a specially crafted URL, leading to the execution of arbitrary JavaScript in the context of the victim's browser session. This can be used to hijack sessions or perform unauthorized actions. The issue is resolved in version 4.1.
Affected products
- PHP Jabbers PHP Poll Script All versions before 4.1
Timeline
- 2026-07-31: disclosed: Advisory published by CERT.PL
- 2026-07-31: patched: Fixed in version 4.1