vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-25297

Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSS

MEDIUM
5.1
CVSS Score
Published: January 16, 2026 at 08:14 PM UTC
Updated: June 17, 2026 at 02:32 AM UTC
1 product affected across 1 vendorPoll Survey Quiz Maker

Using Poll, Survey & Quiz Maker Plugin by Opinion Stage by Assaf Parag?

Get instant alerts when new vulnerabilities affect Poll, Survey & Quiz Maker Plugin by Opinion Stage - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.1
Exploit prediction
EPSS 0.5%
SSVC
PoC

Description

Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Poll Survey Quiz Maker· Assaf Paragwordpress-plugin
60%
v < 19.6.25
Affected range stops below 19.6.25, so it looks safe — our inference, not a vendor statement

References (7)

Third Party AdvisoryPatch
Source: cverecord
https://wpscan.com/vulnerability/4ed1edd6-3813-44a3-bee7-f07c1774b679/
ExploitPatch
Source: cverecord
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-polls-by-opinionstage/poll-survey-quiz-maker-plugin-by-opinion-stage-19625-unauthenticated-stored-cross-site-scripting
Product
Source: cverecord
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-poll-survey-form-quiz-maker-by-opinionstage-cross-site-scripting-19-6-24/
Third Party Advisory
Source: cverecord
https://wordpress.org/plugins/social-polls-by-opinionstage/
Patch
Source: cverecord
https://plugins.trac.wordpress.org/changeset/2158590/social-polls-by-opinionstage
Technical DescriptionExploit
Source: cverecord
https://web.archive.org/web/20191020011448/https://www.pluginvulnerabilities.com/2019/09/16/hackers-may-already-be-targeting-this-persistent-xss-vulnerability-in-poll-survey-form-quiz-maker-by-opinionstage/
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/poll-survey-and-quiz-maker-plugin-by-opinion-stage-stored-xss

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.1MEDIUMVulnCheck
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card