CVE-2025-68081 in WP-Polls Plugin
Summary
by MITRE • 07/23/2026
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability identified as administrator cross site scripting in WP-Polls plugin versions up to 2.77.3 represents a critical security flaw that allows authenticated administrators to be exploited through malicious script injection. This issue falls under the CWE-79 category of Cross-Site Scripting, specifically targeting privileged users within WordPress environments where the plugin is installed. The vulnerability occurs due to insufficient input sanitization and output escaping mechanisms within the plugin's administrative interfaces, creating opportunities for attackers who have gained administrator-level access or can manipulate the plugin's data handling processes.
The technical implementation of this flaw involves the plugin's failure to properly sanitize user-supplied data when processing poll results and administrative configurations. When administrators interact with the WP-Polls interface, particularly when managing poll questions, answers, and voting statistics, the plugin does not adequately escape or filter potentially malicious script content that may have been injected through various attack vectors. This includes scenarios where poll data could be manipulated through API endpoints or direct database modifications, allowing attackers to inject malicious JavaScript code that executes in the context of the administrator's browser session.
From an operational impact perspective, this vulnerability enables attackers with administrator privileges to perform a wide range of malicious activities including but not limited to session hijacking, data exfiltration, privilege escalation to other users, and potential lateral movement within the compromised WordPress environment. The attacker could leverage this vulnerability to steal sensitive information such as user credentials, administrative access tokens, or confidential poll data that might contain personally identifiable information. Additionally, the injected scripts could redirect administrators to malicious websites, install backdoors, or modify plugin configurations to maintain persistent access to the compromised system.
The exploitation of this vulnerability aligns with several ATT&CK techniques including T1566 for credential harvesting and T1078 for valid accounts usage, as the attack requires administrator privileges to be effective. The technique also supports T1213 for data from information repositories, particularly when attackers can extract sensitive poll data or user information through the compromised administrative interface. Security professionals should note that this vulnerability demonstrates the critical importance of input validation and output escaping in web applications, especially within content management systems where privileged users interact with plugin interfaces.
Mitigation strategies for this vulnerability should include immediate patching to WP-Polls version 2.77.4 or later, which implements proper input sanitization and output escaping mechanisms. Organizations should also implement comprehensive monitoring of administrator activities and user access patterns to detect anomalous behavior that might indicate exploitation attempts. Additionally, implementing web application firewalls with XSS protection capabilities can provide additional defense in depth layers. Regular security audits of WordPress plugins and themes are essential to identify similar vulnerabilities, while maintaining up-to-date security policies for privileged user accounts including multi-factor authentication and regular credential rotation to minimize the impact of potential compromises. The vulnerability serves as a reminder of the critical need for proper security coding practices and the importance of thorough testing of input handling mechanisms in web applications.