CVE-2024-12528

Summary

CVE-2024-12528 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress Survey & Poll – Quiz, Survey and Poll Plugin. The issue lies in the plugin's 'wpsurveypoll_results' shortcode, which does not adequately sanitize or escape user-supplied attributes. This weakness allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. Upon accessing an injected page, the scripts will be executed, potentially compromising user data or leading to unintended functionality. Versions of the plugin up to and including 1.7.5 are affected.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.