The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress (versions up to 1.7.5) contains a stored cross-site scripting vulnerability (CWE-79) via the 'wpsurveypoll_results' shortcode. This vulnerability is due to inadequate sanitization and escaping of user input, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

An authenticated attacker with contributor-level access or above can inject persistent malicious scripts into pages using the vulnerable shortcode. When other users view these pages, the scripts execute in their browsers, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.