rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24413 Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Twitter Feed
Credits: lang: en
value: Michał Lipiński
Published: 2021-10-18T13:45:38.000Z
CVE-2021-24414 YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Player for YouTube
Credits: lang: en
value: Michał Lipiński
Published: 2021-10-25T13:20:33.000Z
CVE-2021-24415 Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Polo Video Gallery – Best wordpress video gallery plugin
Credits: lang: en
value: Michał Lipiński
Published: 2021-10-18T13:45:40.000Z
CVE-2021-24416 StreamCast < 2.1.1 - Contributor+ Stored Cross-Site Scripting
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: StreamCast – Radio Player for WordPress
Credits: lang: en
value: Michał Lipiński
Published: 2021-10-18T13:45:41.000Z
CVE-2021-24418 Smooth Scroll Page Up/Down Buttons <= 1.4 - Authenticated Stored XSS via psb_positioning
The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Mark Senff
product: Smooth Scroll Page Up/Down Buttons
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:53.000Z
CVE-2021-24419 WP YouTube Lyte < 1.7.16 - Authenticated Stored XSS
The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP YouTube Lyte
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:54.000Z
CVE-2021-24420 Request a Quote < 2.3.4 - Authenticated Stored XSS
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Request a Quote
Credits: lang: en
value: Ajay Sandipan Thorbole
Published: 2021-07-12T19:20:55.000Z
CVE-2021-24421 WP JobSearch < 1.7.4 - Authenticated Stored XSS
The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP JobSearch
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:56.000Z
CVE-2021-24423 UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: UpdraftPlus WordPress Backup Plugin
Credits: lang: en
value: m0ze
Published: 2022-01-24T08:00:45.000Z
CVE-2021-24424 WP Reset < 1.90 - Authenticated Stored XSS
The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Reset – Most Advanced WordPress Reset Tool
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:57.000Z
CVE-2021-24425 myStickymenu < 2.5.2 - Authenticated Stored XSS
The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu
Credits: lang: en
value: m0ze
Published: 2021-08-02T10:31:54.000Z
CVE-2021-24426 Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Backup by 10Web – Backup and Restore Plugin
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:58.000Z
CVE-2021-24427 W3 Total Cache < 2.1.3 - Authenticated Stored XSS
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: BoldGrid
product: W3 Total Cache
Credits: lang: en
value: m0ze
Published: 2021-07-12T19:20:58.000Z
CVE-2021-24428 RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS
The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: RSS for Yandex Turbo
Credits: lang: en
value: m0ze
Published: 2021-08-02T10:31:55.000Z
CVE-2021-24429 Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Salon Booking System
product: Salon booking system
Credits: lang: en
value: Phu Tran from techlabcorp.com
Published: 2021-07-12T19:20:59.000Z
CVE-2021-24430 Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Speed Booster Pack ⚡ PageSpeed Optimization Suite
Credits: lang: en
value: m0ze
Published: 2021-08-02T10:31:56.000Z
CVE-2021-24431 Language Bar Flags <= 1.0.8 - CSRF to Stored XSS
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Language Bar Flags
Credits: lang: en
value: Vinay Bhuria
Published: 2021-09-13T17:56:14.000Z
CVE-2021-24432 Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced AJAX Product Filters
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2024-01-16T15:49:30.490Z
CVE-2021-24433 Simple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSS
The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "order_sims", "orderby_sims", "period_sims", and "tag_sims" use allowed URL protocols, which can lead to stored cross-site scripting by users with a role as low as Contributor
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: simple sort&search
default_status: affected
Credits: lang: en
value: WPScan
Published: 2024-01-16T15:49:30.825Z
CVE-2021-24434 Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)
The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Glass
Credits: lang: en
value: ABISHEIK M
Published: 2021-07-12T19:21:00.000Z
CVE-2021-24435 Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Titan Framework
Credits: lang: en
value: iohex
Published: 2021-09-06T11:09:24.000Z
CVE-2021-24436 W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: BoldGrid
product: W3 Total Cache
Credits: lang: en
value: renniepak
Published: 2021-07-19T10:53:15.000Z
CVE-2021-24437 Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Favicon by RealFaviconGenerator
Credits: lang: en
value: renniepak
Published: 2021-08-30T14:11:18.000Z
CVE-2021-24438 ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: ShareThis Dashboard for Google Analytics
Credits: lang: en
value: renniepak
Published: 2021-08-30T14:11:19.000Z
CVE-2021-24439 Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Browser Screenshots
Credits: lang: en
value: apple502j
Published: 2021-07-12T19:21:01.000Z
CVE-2021-24440 Sign-up Sheets < 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Sign-up Sheets
Credits: lang: en
value: Ajay Sandipan Thorbole
Published: 2021-07-12T19:21:02.000Z
CVE-2021-24441 Sign-up Sheets < 1.0.14 - Authenticated CSV Injection
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Unknown
product: Sign-up Sheets
Credits: lang: en
value: Ajay Sandipan Thorbole
Published: 2021-07-12T19:21:03.000Z
CVE-2021-24442 Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: wpdevart
product: Poll, Survey, Questionnaire and Voting system
Credits: lang: en
value: Toby Jackson
Published: 2021-07-12T19:21:04.000Z
CVE-2021-24443 Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
Credits: lang: en
value: Phu Tran from techlabcorp.com
Published: 2021-08-02T10:31:57.000Z
CVE-2021-24444 TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: TaxoPress – Create and Manage Taxonomies, Tags, Categories
Credits: lang: en
value: Akash Rajendra Patil
Published: 2021-08-02T00:00:00.000Z
CVE-2021-24445 My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: My Site Audit
Credits: lang: en
value: Akash Rajendra Patil
Published: 2021-08-16T10:48:20.000Z
CVE-2021-24446 Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Remove Footer Credit
Credits: lang: en
value: apple502j
Published: 2022-02-14T09:20:32.000Z
CVE-2021-24447 WP Image Zoom < 1.47 - Local File Inclusion
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: WP Image Zoom
Credits: lang: en
value: apple502j
Published: 2021-07-19T10:53:16.000Z
CVE-2021-24448 Profile Builder < 3.4.8 - Authenticated Stored XSS
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration & User Profile – Profile Builder
Credits: lang: en
value: Akash Rajendra Patil
Published: 2021-08-02T10:31:59.000Z
CVE-2021-24450 ProfilePress < 3.1.8 - Authenticated Stored XSS
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
Credits: lang: en
value: Vaibhav Koli
Published: 2021-08-02T10:32:00.000Z
CVE-2021-24451 Export Users With Meta < 0.6.5 - Authenticated SQL Injection
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Export Users With Meta
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-07-06T11:03:34.000Z
CVE-2021-24452 W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: BoldGrid
product: W3 Total Cache
Credits: lang: en
value: renniepak
Published: 2021-07-19T10:53:17.000Z
CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Include Me
Credits: lang: en
value: Mesut Cetin
Published: 2021-07-19T10:53:18.000Z
CVE-2021-24454 YOP Poll < 6.2.8 - Stored Cross-Site Scripting
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: YOP Poll
Credits: lang: en
value: Toby Jackson
Published: 2021-07-12T19:21:05.000Z