CVE-2025-49044: Simple Poll CSRF Vulnerability

CVE-2025-49044 Overview

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Simple Poll WordPress plugin by tosend.it that can be chained with Stored Cross-Site Scripting (XSS). This vulnerability allows attackers to trick authenticated administrators into performing unintended actions, ultimately leading to persistent malicious script injection into the WordPress site.

Critical Impact

Attackers can leverage CSRF to inject malicious scripts that persist in the database, affecting all users who view the compromised poll content. This chain attack can lead to session hijacking, credential theft, and complete site compromise.

Affected Products

• Simple Poll WordPress Plugin versions up to and including 1.1.1
• WordPress installations with Simple Poll plugin activated

Discovery Timeline

• 2025-08-14 - CVE CVE-2025-49044 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-49044

Vulnerability Analysis

This vulnerability combines two distinct security weaknesses: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The Simple Poll plugin fails to implement proper CSRF token validation on administrative actions, allowing attackers to craft malicious requests that execute in the context of authenticated administrators.

When an administrator visits a malicious page while logged into WordPress, the attacker's crafted request is automatically submitted to the vulnerable plugin endpoint. Because the plugin also lacks proper output sanitization, the attacker can inject malicious JavaScript that gets stored in the database and executed whenever the poll content is rendered.

Root Cause

The root cause is twofold: First, the plugin does not verify CSRF nonces on form submissions or AJAX requests that modify poll data (CWE-352). Second, the plugin fails to properly sanitize and escape user-supplied input before storing it in the database and rendering it back to users. This combination creates a dangerous attack chain where CSRF enables Stored XSS injection.

Attack Vector

The attack requires social engineering to lure an authenticated WordPress administrator to a malicious webpage. The attacker's page contains a hidden form or JavaScript that automatically submits a request to the vulnerable Simple Poll endpoint. Since no CSRF protection exists, the request executes with the administrator's privileges, injecting malicious JavaScript into poll content.

The injected script persists in the WordPress database and executes in the browsers of all users who subsequently view the compromised poll. This can lead to session token theft, administrative credential harvesting, malware distribution, or site defacement.

Detection Methods for CVE-2025-49044

Indicators of Compromise

• Unexpected JavaScript or HTML content in poll questions, answers, or settings
• Database entries in poll-related tables containing <script> tags or event handlers
• Server logs showing unusual POST requests to Simple Poll admin endpoints from external referrers
• User reports of unexpected redirects or pop-ups when viewing polls

Detection Strategies

• Review WordPress database tables associated with Simple Poll for suspicious script content or encoded payloads
• Monitor HTTP access logs for POST requests to plugin admin endpoints originating from external domains
• Implement Content Security Policy (CSP) headers to detect and block unauthorized inline script execution
• Deploy Web Application Firewall (WAF) rules to detect XSS payloads in form submissions

Monitoring Recommendations

• Enable WordPress audit logging to track plugin configuration changes and poll modifications
• Set up alerts for administrative actions performed without corresponding user activity in the WordPress dashboard
• Regularly scan poll content and plugin database entries for malicious payloads using security plugins

How to Mitigate CVE-2025-49044

Immediate Actions Required

• Deactivate the Simple Poll plugin until a patched version is available
• Audit existing poll content in the database for injected malicious scripts
• Review server access logs for suspicious requests to the plugin's administrative endpoints
• Inform website administrators about the risk and ensure they avoid clicking untrusted links while logged in

Patch Information

No patched version has been confirmed at the time of publication. Affected users should monitor the Patchstack Vulnerability Report for updates and patch availability. Consider replacing the plugin with an alternative polling solution that has active security maintenance.

Workarounds

• Disable or remove the Simple Poll plugin entirely from the WordPress installation
• Restrict access to the WordPress admin dashboard to trusted IP addresses only
• Implement additional security headers including Content-Security-Policy to mitigate XSS impact
• Use a Web Application Firewall (WAF) to block CSRF and XSS attack patterns
• Ensure administrators are trained to avoid clicking links from untrusted sources while authenticated

# Deactivate Simple Poll plugin via WP-CLI
wp plugin deactivate simple-poll

# Check for suspicious content in the database (example query)
# Review results manually for malicious JavaScript
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%simple_poll%' AND option_value LIKE '%<script%';"