CVE-2016-20066 Overview
CVE-2016-20066 is a persistent cross-site scripting (XSS) vulnerability in the WordPress CP Polls plugin version 1.0.8. The plugin fails to sanitize file uploads, allowing authenticated attackers to inject JavaScript payloads through crafted filenames or file content containing event handlers such as onerror. When users view the affected poll content, the stored script executes in their browsers. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Stored XSS enables session hijacking, credential theft, and arbitrary actions performed in the context of authenticated WordPress users, including administrators viewing the malicious poll content.
Affected Products
- WordPress CP Polls plugin version 1.0.8
- WordPress installations with the CP Polls plugin enabled
- Sites permitting authenticated users to interact with poll upload functionality
Discovery Timeline
- 2026-06-15 - CVE-2016-20066 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2016-20066
Vulnerability Analysis
The CP Polls plugin accepts file uploads as part of its poll functionality without applying output encoding or input sanitization. Attackers can upload files whose names or contents include HTML tags with JavaScript event handlers. The plugin then renders this attacker-controlled data within poll pages, causing the browser to interpret the payload as executable script rather than inert text. Because the payload is persisted server-side, every visitor to the affected poll triggers script execution without further attacker interaction.
This is a classic stored XSS pattern in which untrusted data crosses the trust boundary into a rendered HTML context. The vulnerability requires low-privilege authentication and user interaction with the affected poll page. Successful exploitation does not require code execution on the WordPress host itself; the attack runs entirely in victim browsers.
Root Cause
The root cause is missing neutralization of HTML special characters in user-supplied file upload data before reflection into the poll rendering output. The plugin trusts uploaded filenames and content as safe display data. There is no allow-list of permitted file types, no MIME validation, and no HTML entity encoding applied during rendering, allowing tags like <img src=x onerror=...> to execute.
Attack Vector
An authenticated attacker with permission to upload files through the CP Polls interface submits a file whose name or content contains a JavaScript payload using event handler attributes. The plugin stores the malicious data and later serves it to other users. When an administrator or visitor loads the page that renders the poll, the browser executes the attacker's script. Refer to the Exploit-DB entry #39513 and the VulnCheck WordPress Advisory for technical details on the payload construction.
No verified public proof-of-concept code is provided in this enrichment. Available references describe the payload pattern as HTML elements carrying onerror handlers smuggled through the upload field.
Detection Methods for CVE-2016-20066
Indicators of Compromise
- Uploaded files in the CP Polls plugin directory containing HTML tags or JavaScript event handler attributes such as onerror, onload, or onclick
- WordPress audit log entries showing file uploads with unusual filenames containing angle brackets, quotes, or script keywords
- Unexpected outbound browser requests to attacker-controlled domains originating from pages rendering poll content
Detection Strategies
- Inspect HTTP request bodies posted to CP Polls upload endpoints for HTML or JavaScript syntax in filename and content fields
- Scan the WordPress uploads directory for stored files whose contents include <script>, onerror=, or similar XSS markers
- Review web server access logs for POST requests to plugin upload handlers followed by GET requests returning the stored payload in HTML responses
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin upload events tied to user accounts
- Deploy a web application firewall with stored XSS rule sets covering event handler attributes in multipart uploads
- Alert on anomalous administrator session activity such as unexpected user creation or settings changes that may follow successful XSS exploitation
How to Mitigate CVE-2016-20066
Immediate Actions Required
- Disable or remove the CP Polls plugin from WordPress installations until a patched version is confirmed available
- Audit existing poll content and uploaded files for embedded script payloads and remove any suspicious artifacts
- Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected
Patch Information
No vendor patch is referenced in the available advisory data. Operators should consult the VulnCheck advisory for current remediation status and consider replacing CP Polls with an actively maintained polling plugin.
Workarounds
- Restrict CP Polls upload permissions to trusted administrative roles only, reducing the population of users who can introduce malicious files
- Deploy a Content Security Policy (CSP) restricting inline script execution and limiting script sources to trusted origins
- Place a web application firewall rule in front of WordPress that blocks multipart uploads containing HTML event handler attributes
# Example WordPress configuration: disable the plugin via WP-CLI
wp plugin deactivate cp-polls
wp plugin delete cp-polls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
