CVE-2019-9914

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2019/Mar/43Exploit, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/02/05/15Exploit, Mailing List, Third Party Advisory
https://security-consulting.icu/blog/2019/02/wordpress-yop-poll-xss/Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Mar/43Exploit, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/02/05/15Exploit, Mailing List, Third Party Advisory
https://security-consulting.icu/blog/2019/02/wordpress-yop-poll-xss/Exploit, Third Party Advisory

Timeline

Published: Mar 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99156.1GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.CVE-2019-99176.5ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.CVE-2019-99189.1An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in CVE-2019-99195.4An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript ge CVE-2019-99208.8An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action within the context of th CVE-2019-99216.5An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that should only be acces CVE-2019-99227.5An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.CVE-2019-99237.5pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extend CVE-2019-99247.8rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with t CVE-2019-99256.1S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.CVE-2019-99268.8An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewSc CVE-2019-99279.8Caret before 2019-02-22 allows Remote Code Execution.