In the ACF Onyx Poll WordPress plugin, the class parameter is not properly sanitized or escaped before being stored. An authenticated author with Contributor level or higher can place arbitrary JavaScript into the poll content. When another site visitor accesses the poll page, the injected script runs in their browser, enabling session hijacking, data theft, or defacement. The vulnerability is a classic stored XSS flaw (CWE‑79).

The flaw affects the ACF Onyx Poll plugin produced by Andremacola, used on any WordPress installation. All releases up to and including version 1.1.9 are vulnerable. WordPress sites that have installed these versions, and have users with Contributor or higher roles, are impacted.

With a CVSS score of 6.4, this vulnerability is moderate but still noteworthy. The EPSS score of less than 1 % signals that exploitation is currently rare, and the flaw is not listed in the CISA KEV catalog. Attackers must have login credentials and a role of Contributor or above, which is easier to obtain than administrative rights. Once a poll page is viewed, any user in the browser receives the injected code, creating a widespread exposure. Even though the exploit probability is low, the potential for user session compromise and defacement warrants prompt attention.