The YOP Poll plugin for WordPress is vulnerable to unauthenticated cross-site scripting, which could allow attackers to execute arbitrary scripts in the browsers of site users.

This is a cross-site scripting (CWE-79) vulnerability where the plugin fails to properly neutralize user input. An unauthenticated attacker can supply malicious scripts that are subsequently rendered by the application, affecting any user who views the compromised page.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an unsuspecting user session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, or the defacement of the affected website, potentially leading to reputational damage. With a CVSS score of 7.1, this vulnerability is categorized as High severity due to the potential for significant impact on site integrity and user security.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official WordPress plugin repository for security updates and apply them as soon as they become available. If no update is released promptly, consider deactivating the plugin until a fix is provided.

Proactive Monitoring: Review web server and application logs for suspicious input patterns, particularly those containing script tags or encoded characters directed toward the plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to detect and block malicious injection attempts targeting the affected plugin parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of XSS vulnerabilities, this issue poses a significant risk to site visitors and administrative sessions. Administrators should prioritize checking for plugin updates and be prepared to remove the plugin if the vendor does not release a resolution in a timely manner.