CVE-2024-3601: falha de média gravidade em ays-pro Poll Maker – Versus Polls, Anonymous…
Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
ays-pro · Poll Maker – Versus Polls, Anonymous Polls, Image PollsCVEs relacionadas — ays-pro Poll Maker – Versus Polls, Anonymous…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-9874MEDIUMWordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL InjectionEPSS 0.7%CVE-2024-9475MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by ParameterEPSS 0.5%CVE-2024-3600HIGHPoll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9462MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll SettingsEPSS 0.3%CVE-2025-12620MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` ParameterEPSS 0.3%CVE-2024-12575MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information ExposureEPSS 0.3%