Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:yop_poll:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Yop Poll (d844b494-0dcd-5783-be19-5579f6922c6a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14840 |
vulnerable | 2026-09-16 04:33:12.364740 |
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
Published: 2026-08-01T06:00:14.327Z
Updated: 2026-08-05T16:18:26.397Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1600 |
vulnerable | 2026-06-08 05:39:13.531385 |
YOP Poll < 6.4.3 - IP Spoofing
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Published: 2022-08-01T12:48:14.000Z
Updated: 2024-08-03T00:10:03.637Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0205 |
vulnerable | 2026-06-08 05:39:09.481150 |
YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
Published: 2022-03-07T08:16:23.000Z
Updated: 2024-08-02T23:18:42.555Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24885 |
vulnerable | 2026-06-08 05:30:39.557782 |
YOP Poll < 6.1.2 - Reflected Cross-Site Scripting
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Published: 2021-10-25T13:21:01.000Z
Updated: 2024-08-03T19:49:12.695Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24834 |
vulnerable | 2026-06-08 05:30:39.323646 |
YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Published: 2021-11-17T10:15:47.000Z
Updated: 2024-08-03T19:42:17.214Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24833 |
vulnerable | 2026-06-08 05:30:39.322598 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24454 |
vulnerable | 2026-06-08 05:30:04.405124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.