CVE-2024-3600: Poll Maker WordPress Plugin XSS Vulnerability

CVE-2024-3600 Overview

CVE-2024-3600 is a Stored Cross-Site Scripting (XSS) vulnerability in the Poll Maker – Best WordPress Poll Plugin developed by Ays-pro. The flaw exists in all versions up to and including 5.1.8. It stems from a missing capability check on the ays_poll_maker_quick_start AJAX action combined with insufficient input sanitization and output escaping. Unauthenticated attackers can create quizzes and inject malicious JavaScript that executes in the browser of any user who visits the affected page. The vulnerability is tracked under CWE-862 (Missing Authorization) and CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress sites running vulnerable Poll Maker versions, enabling session theft, redirects, and administrative account takeover when an admin views the injected content.

Affected Products

Ays-pro Poll Maker (free WordPress plugin) versions through 5.1.8
WordPress sites with the poll-maker plugin installed and activated
All deployments exposing the admin-ajax.php endpoint to unauthenticated visitors (default WordPress configuration)

Discovery Timeline

2024-04-19 - CVE-2024-3600 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3600

Vulnerability Analysis

The vulnerability resides in the ays_poll_maker_quick_start AJAX handler exposed by the Poll Maker plugin. WordPress registers AJAX actions through the wp_ajax_ and wp_ajax_nopriv_ hooks. When a handler is registered on the nopriv variant without an explicit capability or nonce check, any unauthenticated visitor can invoke it by sending a POST request to admin-ajax.php. In this case, the handler accepts poll and quiz content and stores it without adequate sanitization. The stored payload is later rendered to visitors and administrators without proper escaping, allowing arbitrary JavaScript execution within the site's origin.

Root Cause

Two defects combine to create the vulnerability. First, the ays_poll_maker_quick_start action lacks an authorization check, violating the principle of least privilege (CWE-862). Second, user-supplied fields consumed by the handler are neither sanitized on input using functions such as wp_kses_post() nor escaped on output with helpers like esc_html() or esc_attr() (CWE-79). The upstream fix is available in the WordPress Plugin Changeset.

Attack Vector

An attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=ays_poll_maker_quick_start and quiz parameters containing a JavaScript payload. Because the handler skips authorization, the malicious quiz is persisted in the WordPress database. When any user (including a logged-in administrator) loads the page rendering the poll, the browser executes the injected script under the site's origin. Successful exploitation requires user interaction (page visit) but no credentials. Attackers commonly leverage such flaws to hijack administrator sessions, insert backdoor accounts, or redirect visitors to malicious infrastructure. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-3600

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php with the parameter action=ays_poll_maker_quick_start
New or unexpected quiz or poll entries created in the wp_ayspoll_* database tables containing <script>, onerror=, onload=, or javascript: strings
Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages that embed Poll Maker content
Creation of new WordPress administrator accounts or unexpected changes to wp_users and wp_usermeta following visits to poll pages

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php referencing the ays_poll_maker_quick_start action, particularly from unauthenticated IPs
Query the WordPress database for poll and quiz records containing HTML event handlers or <script> tags
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated invocations of the vulnerable AJAX action
Use file integrity monitoring on the wp-content/plugins/poll-maker directory to detect tampering

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward records to a centralized SIEM for correlation
Alert on anomalous privilege changes, plugin installations, or theme edits performed shortly after suspicious AJAX activity
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages rendering Poll Maker content

How to Mitigate CVE-2024-3600

Immediate Actions Required

Update the Poll Maker plugin to a version later than 5.1.8 that includes the fix referenced in the WordPress Plugin Changeset
Audit all existing polls and quizzes for HTML tags, event handlers, or script content and remove any suspicious entries
Rotate WordPress administrator passwords and force logout of active sessions if evidence of exploitation exists
Review the WordPress user table for unauthorized administrator accounts

Patch Information

The vendor addressed CVE-2024-3600 in the Poll Maker plugin after version 5.1.8. The patch adds a capability check to the ays_poll_maker_quick_start AJAX action and applies proper sanitization and escaping to user-supplied fields. WordPress administrators should apply the update through the plugin dashboard or via WP-CLI. Detailed remediation notes are available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the Poll Maker plugin until the patched version can be deployed
Deploy a WAF rule to block unauthenticated POST requests to admin-ajax.php where the action parameter equals ays_poll_maker_quick_start
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads

bash

# Update Poll Maker via WP-CLI
wp plugin update poll-maker

# Or deactivate the plugin as a temporary workaround
wp plugin deactivate poll-maker