CVE-2021-24833
Last modified
CVE-2021-24833 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.. EPSS estimates a 1.09% chance of exploitation in the next 30 days.
Description
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Yop-Poll | Yop Poll | < 6.3.1 |
References
- https://plugins.trac.wordpress.org/changeset/2605368Patch, Third Party Advisory
- https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34Third Party Advisory
- https://www.fortiguard.com/zeroday/FG-VD-21-052Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2605368Patch, Third Party Advisory
- https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34Third Party Advisory
- https://www.fortiguard.com/zeroday/FG-VD-21-052Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-24833?
How severe is CVE-2021-24833?
How do I fix CVE-2021-24833?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-24828The Mortgage Calculator / Loan Calculator WordPress plugin b…5.4
- CVE-2021-24829The Visitor Traffic Real Time Statistics WordPress plugin be…8.8
- CVE-2021-2483Vulnerability in the Oracle Content Manager product of Oracl…8.1
- CVE-2021-24830The Advanced Access Manager WordPress plugin before 6.8.0 do…4.8
- CVE-2021-24831All AJAX actions of the Tab WordPress plugin before 1.3.2 ar…7.5
- CVE-2021-24832The WP SEO Redirect 301 WordPress plugin before 2.3.2 does n…4.3
- CVE-2021-24834The YOP Poll WordPress plugin before 6.3.1 is affected by a …5.4
- CVE-2021-24835The WCFM – Frontend Manager for WooCommerce along with Booki…8.8
- CVE-2021-24836The Temporary Login Without Password WordPress plugin before…4.3
- CVE-2021-24837The Passster WordPress plugin before 3.5.5.8 does not escape…5.4
- CVE-2021-24838The AnyComment WordPress plugin before 0.3.5 has an API endp…6.1
- CVE-2021-24839The SupportCandy WordPress plugin before 2.2.5 does not have…7.5
Are you affected by CVE-2021-24833?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST