CVE-2025-57954 Overview
CVE-2025-57954 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Ays Pro Poll Maker plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. All versions of Poll Maker up to and including 6.0.2 are affected. An authenticated attacker with low privileges can craft input that executes arbitrary JavaScript in a victim's browser after user interaction. Successful exploitation impacts confidentiality, integrity, and availability at a limited scope, and the scope change indicates the payload can affect resources beyond the vulnerable component.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, unauthorized actions within the WordPress site, and defacement of poll content.
Affected Products
- Ays Pro Poll Maker WordPress plugin, versions up to and including 6.0.2
- WordPress sites running the poll-maker plugin with public poll rendering
- Administrator and editor sessions interacting with poll data
Discovery Timeline
- 2025-09-22 - CVE-2025-57954 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57954
Vulnerability Analysis
The vulnerability is a client-side DOM-Based XSS issue in the Poll Maker plugin. Client-side JavaScript in the plugin reads attacker-controlled data and writes it into the Document Object Model without proper sanitization or output encoding. Because the payload is processed entirely in the browser, server-side web application firewalls may fail to see the injection.
Exploitation requires low privileges and user interaction, meaning an authenticated user with contributor-level or similar access can inject payloads that fire when another user views affected poll pages or administrative screens. The scope change reflects that JavaScript executed in an administrator's browser can act on WordPress resources outside the plugin's boundary.
Root Cause
The root cause is missing input neutralization on data rendered into the DOM by the plugin's client-side scripts. The plugin trusts poll-related parameters and inserts them into HTML sinks such as innerHTML or jQuery .html() without encoding. This pattern allows <script> blocks, event-handler attributes, and JavaScript URIs to execute in the visitor's browser.
Attack Vector
The attack vector is network-based. An attacker with low-privileged authentication submits a poll question, answer, or related field containing a JavaScript payload. When another user, including a site administrator, loads a page that renders the poll data, the payload executes in that user's browser session. The vulnerability mechanism is documented in the Patchstack XSS Vulnerability Report. No public exploit code or proof-of-concept has been catalogued in Exploit-DB, and CISA has not added this issue to the Known Exploited Vulnerabilities list.
Detection Methods for CVE-2025-57954
Indicators of Compromise
- Poll questions, answers, or metadata containing HTML tags such as <script>, <img onerror=>, or javascript: URIs
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting poll pages
- Unexpected creation of WordPress administrator accounts or modification of plugin settings following poll interaction
- Anomalous wp-admin activity originating from low-privileged accounts that authored polls
Detection Strategies
- Review the wp_ayspoll_* database tables for poll content containing HTML or JavaScript syntax
- Enable Content Security Policy (CSP) reporting to capture inline script violations on pages rendering polls
- Correlate WordPress audit logs with plugin activity to identify low-privileged users submitting suspicious poll data
- Scan rendered poll pages with an automated DOM XSS scanner to flag unsanitized sinks
Monitoring Recommendations
- Monitor HTTP request bodies to admin-ajax.php and REST endpoints associated with the poll-maker plugin for HTML tags and script fragments
- Alert on new or modified WordPress user roles following poll submissions from contributor accounts
- Track browser console errors and CSP violation reports across administrative sessions
How to Mitigate CVE-2025-57954
Immediate Actions Required
- Update the Ays Pro Poll Maker plugin to a version later than 6.0.2 once the vendor publishes a fix
- Audit all existing polls for embedded HTML or JavaScript and remove any suspicious content
- Restrict poll authoring permissions to trusted, high-privilege accounts until the plugin is patched
- Force password resets and session invalidation for administrators who may have viewed malicious poll pages
Patch Information
At the time of publication, the vendor advisory referenced by Patchstack confirms all versions through 6.0.2 are vulnerable. Administrators should monitor the plugin's WordPress.org page for a security release above 6.0.2 and apply it as soon as it is available.
Workarounds
- Deactivate the Poll Maker plugin until a patched version is released
- Deploy a strict Content Security Policy that blocks inline scripts and untrusted script sources on pages rendering polls
- Configure a web application firewall rule to strip HTML tags from parameters submitted to poll-maker endpoints
- Limit contributor and author accounts on the site and require multi-factor authentication for all editorial roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
