CVE-2013-1400

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/57479Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/81466Third Party Advisory, VDB Entry
https://www.securityfocus.com/archive/1/525370Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/57479Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/81466Third Party Advisory, VDB Entry
https://www.securityfocus.com/archive/1/525370Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 13, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-14019.8Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 CVE-2013-14025.0DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration CVE-2013-140510.0VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b an CVE-2013-14067.2The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on CVE-2013-14074.3Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for CVE-2013-14086.5Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators CVE-2013-14094.3Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary we CVE-2013-14106.1Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities CVE-2013-14127.5DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is CVE-2013-14134.3Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when t CVE-2013-14145.1Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.CVE-2013-14155.0The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Ce