CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.77.
Explanation of Vulnerability in Simple Terms
LiquidPoll versions up to 3.3.77 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into poll content. An attacker with network access can craft a malicious poll without authentication, and the injected script executes in users' browsers when they view the poll. This can compromise user sessions, steal data, or redirect visitors to malicious sites.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they view a poll.
Potential impact on your site
Visitors viewing polls may have their sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
