CVE-2016-20066: WordPress CP Polls 1.0.8 Persistent XSS Vulnerability

Technical summary

CP Polls 1.0.8 fails to properly sanitize file uploads, enabling persistent XSS injection. The vulnerability stems from insufficient input validation on uploaded files—specifically, the plugin does not strip or encode dangerous HTML/JavaScript constructs like event handlers before storing or rendering user-supplied content. When an infected file is accessed through the plugin's interface, the embedded scripts execute in the context of the victim's browser with the privileges of their session. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), and the CVSS v3.1 score of 7.2 reflects a network-accessible attack requiring no authentication or user interaction to trigger—though impact is limited to confidentiality and integrity (no availability impact).

Business impact

Organizations using CP Polls 1.0.8 face exposure to session hijacking, account compromise, and malware distribution through their WordPress sites. Attackers can harvest credentials from site administrators and logged-in users, inject persistent malicious content visible to all visitors, or use the compromised site as a staging ground for further attacks. For multi-user or public-facing WordPress installations, the reputational damage and compliance implications (data exfiltration, unauthorized modifications) can be significant. The persistent nature of this XSS means the threat remains active until the malicious file is discovered and removed.

Affected systems

The vulnerability specifically affects WordPress CP Polls plugin version 1.0.8. Organizations should immediately identify all WordPress installations running this version. If your site uses CP Polls, verify the installed version through the WordPress plugin management interface. Sites running versions prior to 1.0.8 or patched versions (verify against the vendor advisory for the fixed version number) are not affected by this specific vulnerability.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to upload a specially crafted file with embedded scripts and event handlers through the CP Polls upload functionality. No user interaction beyond viewing the affected content is required—the malicious script will execute automatically when the page renders. The attack surface is broad if the upload feature is accessible to unauthenticated users or to low-privileged users. The fact that it is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog does not indicate unavailability of exploit techniques; it reflects the absence of confirmed active exploitation in the wild as of the last KEV update.

Remediation

Immediately update the CP Polls plugin to a patched version released by the developer (verify the specific version number against the official plugin repository or vendor advisory). If no patch is yet available, disable the CP Polls plugin until an update is released. Additionally, audit your WordPress site for any suspicious files uploaded recently, review user accounts for unauthorized access, and inspect site content for injected scripts. Consider implementing a Web Application Firewall (WAF) rule to block uploads containing script tags or event handlers as a compensating control.

Patch guidance

Check the official WordPress plugin repository or the CP Polls developer's website for an updated version of the plugin. Apply the patch immediately upon availability by navigating to Plugins > Installed Plugins in your WordPress dashboard, selecting CP Polls, and clicking Update. After patching, clear any cached content and perform a security scan to detect any malicious files uploaded before the patch was applied. Document the patching date and audit log for compliance purposes.

Detection guidance

Search your WordPress uploads directory and plugin storage for files containing suspicious script tags, onerror, onclick, or other event handler attributes. Review your WordPress error logs and web server access logs for unusual POST requests to file upload endpoints associated with CP Polls. Monitor for unexpected changes to plugin files or new files in the uploads folder. If you use a WordPress security plugin (such as Wordfence or Sucuri), enable file integrity monitoring to alert on unauthorized file modifications or uploads. Check user account activity logs for any unauthorized changes made via XSS injection.

Why prioritize this

This vulnerability should be prioritized for immediate patching due to its HIGH severity rating (CVSS 7.2), broad network attack surface, and persistence. Unlike reflected XSS, persistent XSS affects every user who views the compromised content, making it a site-wide threat. The lack of user interaction required to trigger execution, combined with the potential for large-scale user compromise, elevates urgency. Organizations running public-facing or multi-user WordPress sites with CP Polls should treat this as a critical issue.

Risk score, explained

The CVSS v3.1 score of 7.2 reflects the following factors: Network accessibility (AV:N) lowers the barrier to attack; no privilege requirements (PR:N) or user interaction (UI:N) required means any visitor or attacker can attempt exploitation; low attack complexity (AC:L) indicates straightforward exploitation; scope is changed (S:C), meaning impact extends beyond the vulnerable component to other users and systems; confidentiality and integrity are impacted (C:L, I:L) through potential credential theft and content manipulation; availability is not impacted (A:N). The score lands in the HIGH band, warranting swift remediation.

Frequently asked questions