Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · yop-poll
YOP Poll
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 24, 2026YOP Poll: Origin Validation ErrorCVE-2026-85682 · affects up to 7.0.10 · reported by WordfenceHigh 8.8
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
Aug 1, 2026YOP Poll: Does not validate the connection's origin IP address and instead trusts client-controlled forwarding headersCVE-2026-14840 · fixed in 7.0.6 · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
Nov 13, 2025YOP Poll: Missing AuthorizationCVE-2025-64370 · affects up to 6.5.38 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Poll: from n/a through <= 6.5.38.
Nov 6, 2025YOP Poll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62040 · affects up to 6.5.37 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YOP YOP Poll yop-poll.This issue affects YOP Poll: from n/a through <= 6.5.37.
Jan 2, 2025YOP Poll: Authentication Bypass by Primary WeaknessCVE-2023-46611 · affects up to 6.5.28 · reported by PatchstackMedium 5.3
Authentication Bypass by Primary Weakness vulnerability in yourownprogrammer YOP Poll allows Authentication Bypass.This issue affects YOP Poll: from n/a through 6.5.28.
Nov 14, 2023YOP Poll: A race conditionCVE-2023-6109 · affects up to 6.5.26 · reported by WordfenceMedium 5.3
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.
Aug 1, 2022YOP Poll: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1600 · fixed in 6.4.3 · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · fixed in 6.3.5 · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24834 · fixed in 6.3.1 · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24833 · fixed in 6.3.1 · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · fixed in 6.1.2 · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Jul 12, 2021In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "ShCVE-2021-24454 · fixed in 6.2.8 · reported by WPScanMedium 6.1
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
Mar 21, 2019The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.CVE-2019-9914 · fixed in 6.0.3 · reported by MITREMedium 6.1
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.