vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-3600

Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting

MEDIUM
6.1
CVSS Score
Published: April 19, 2024 at 02:34 AM UTC
Updated: June 17, 2026 at 07:44 AM UTC
2 products affected across 1 vendorPoll MakerPoll Maker

Using Poll Maker – Best WordPress Poll Plugin by ays-pro?

Get instant alerts when new vulnerabilities affect Poll Maker – Best WordPress Poll Plugin - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Poll Maker· Ays Prowordpress-plugin
95%
v < 5.1.8v < 5.1.9
Affected range stops below 5.1.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.1.9, so it looks safe — our inference, not a vendor statement
Poll Maker· Ays Prowordpress-plugin
60%
v ≤ 5.1.8

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Product
Source: [email protected]
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071296%40poll-maker&new=3071296%40poll-maker&sfp_email=&sfph_mail=
Third Party Advisory
Source: [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/fec015e1-7f64-4917-a242-90bd1135f680?source=cve

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card