What is CVE-2024-3600?

CVE-2024-3600 is a high-severity vulnerability in Ays-Pro Poll Maker, classified under Missing Authorization. CVSS score: 7.2/10. Published 2024-04-19.

How severe is CVE-2024-3600?

High severity. CVSS v3 base score is 7.2 out of 10.

Is CVE-2024-3600 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Ays-Pro Poll Maker

CVE-2024-3600

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.

Vulnerability class: Broken Access Control

EPSS: 0.004 (30.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Ays-pro Poll_maker
Ays-pro Poll Maker – Versus Polls, Anonymous Image Polls — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

20142995/nuclei-templates

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)

Frequently asked questions

What is CVE-2024-3600?: CVE-2024-3600 is a high-severity vulnerability in Ays-Pro Poll Maker, classified under Missing Authorization. CVSS score: 7.2/10. Published 2024-04-19.
How severe is CVE-2024-3600?: High severity. CVSS v3 base score is 7.2 out of 10.
Is CVE-2024-3600 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.