CVE-2024-3600 is a stored cross-site scripting vulnerability in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin due to missing authorization checks on the ays_poll_maker_quick_start AJAX action and inadequate input sanitization and escaping. This flaw allows unauthenticated attackers to inject malicious scripts into quizzes, which execute in the context of users visiting the affected pages. The vulnerability affects all versions up to and including 5.1.8. The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality and integrity with no privileges or user interaction required.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts within quizzes created via the vulnerable AJAX action. When legitimate users view these quizzes, the malicious scripts execute in their browsers, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — no official patch or vendor advisory is provided in the available data. Users should monitor the vendor's official channels for updates and apply patches once available. Until then, consider disabling or restricting access to the vulnerable AJAX action if possible. Avoid using affected versions and apply web application firewall (WAF) rules to detect and block suspicious requests targeting the ays_poll_maker_quick_start action.