CVE-2021-24833: yop-poll yop poll

csirt@kutim:~/threat-intel/cve/CVE-2021-24833

CVSS 5.4 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada yop-poll yop poll. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.

Rincian

Terbit di NVD: 17 November 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 65,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
yop-poll	yop poll	Semua versi sebelum 6.3.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/2605368 patch · advisory pihak ketiga
https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34 advisory pihak ketiga
https://www.fortiguard.com/zeroday/FG-VD-21-052 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.