CVE-2016-20066

Vulnerability

WordPress CP Polls plugin version 1.0.8 (and possibly earlier versions) contains a persistent cross-site scripting (XSS) vulnerability [1]. The plugin fails to properly sanitize values from file uploads before storing them in the database. This allows an attacker to upload a file containing malicious script payloads with event handlers, such as onerror, that will execute arbitrary JavaScript in the browser of any user viewing the affected poll content.

Exploitation

An attacker can exploit this vulnerability by first uploading a file with a crafted script payload via the poll's file upload functionality [1][2]. Successful exploitation may require a privileged user (e.g., an administrator) to perform an action, such as clicking a malicious link that triggers a cross-site request forgery (CSRF) attack [1]. The attacker does not need direct authentication; they can use CSRF to trick the administrator into uploading the malicious file or otherwise saving the unsanitized payload. The script executes when a victim views the page containing the uploaded file.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's browser session [1][2]. Since the XSS is persistent, every user who visits the affected poll page will execute the injected script. Depending on the victim's privileges, this can result in session hijacking, defacement, or theft of sensitive data. The attacker does not gain direct server-level access but can perform any action that the victim user can within the WordPress admin panel.

Mitigation

As of the vulnerability disclosure (2016-02-22), the affected version CP Polls 1.0.8 is the latest. The vendor (dwbooster) has not released a security update to address this issue [1]. Users are advised to disable or remove the plugin until a fix is available, or to implement a web application firewall rule that blocks malicious file uploads. No CISA KEV listing is known.