Known vulnerabilities in WP-Polls

Adds an AJAX poll system to your WordPress blog. You can also easily add a poll into your WordPress's blog post/page.

7Reported vulnerabilities

9.8Highest CVSS score

3.0.0Latest version

40,000+Active installs

What to do now

Update WP-Polls to 3.0.0 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 9, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2015-9352	Critical 9.8	1.8%	Before 2.72	`2.72`	August 27, 2019
CVE-2022-1581	Medium 5.3	0.6%	Before 2.76.0	`2.76.0`	November 21, 2022
WF-e25f524e-360d-4c80-a0ab-90ee94825b1b	High 7.2	—	2.70 and earlier	`2.71`	August 14, 2015
CVE-2016-10936	Medium 6.1	0.9%	Before 2.73.1	`2.73.1`	August 27, 2019
CVE-2024-13426	Medium 5.3	0.5%	Before 2.77.3	`2.77.3`	January 22, 2025
CVE-2025-68081	Medium 4.4	0.2%	2.77.3 and earlier	`3.0.0`	July 22, 2026
CVE-2022-40130	Low 3.1	0.4%	Before 2.77.0	`2.77.0`	November 18, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.