CVE-2024-29818: 
WordPress vulnerability analysis and mitigation

The WP Poll Maker plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-29818) affecting versions up to and including 3.1. The vulnerability was discovered on March 25, 2024, and has been fixed in version 3.4 (WPScan, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.9 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The security flaw exists due to insufficient input sanitization and output escaping in the admin settings (Patchstack).

This vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. The impact is limited to multi-site installations and installations where unfiltered_html has been disabled (WPScan).

The vulnerability requires administrator-level access to exploit, making it less likely to be widely exploited in the wild. The attack requires user interaction and high privileges to execute (Patchstack).

Users are advised to update to WP Poll Maker version 3.4 or later to remediate this vulnerability. This is the primary and recommended solution to address the security issue (Patchstack).