CVE-2024-9462 is a stored cross-site scripting vulnerability (CWE-79) in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin versions up to and including 5.4.6. The vulnerability is due to improper neutralization of input during web page generation, specifically in poll settings, which allows authenticated administrators or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the affected pages. The issue affects multi-site installations or installations with unfiltered_html disabled. No official patch or fix information is provided in the available data.

An attacker with administrator-level permissions can inject malicious scripts that execute in the browsers of users who visit the affected poll pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. The impact is constrained by the requirement for high privileges (administrator or above) and specific WordPress configurations (multi-site or unfiltered_html disabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the affected plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once released.