CVE-2019-25297
Medium
Description
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
SeverityMedium
CVSS5.1
Exploit probability40. percentile0.5%
ProductPoll, Survey & Quiz Maker Plugin by Opinion Stage
PublishedJan 16, 2026
First seenJan 16, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage19.6.25 or later
Patches
- wpscan.com/vulnerability/4ed1edd6-3813-44a3-bee7-f07c1774b679/
- wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-polls-by-opinionstage/poll-survey-quiz-maker-plugin-by-opinion-stage-19625-unauthenticated-stored-cross-site-scripting
- plugins.trac.wordpress.org/changeset/2158590/social-polls-by-opinionstage
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage | v < 19.6.25 | 19.6.25 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.