This vulnerability results from improper neutralization of user input when generating web pages in the YOP Poll plugin. The failure to escape or sanitize data allows an attacker to inject malicious scripts into poll pages that are viewed by users. Successful exploitation could lead to client‑side code execution, enabling session hijacking, credential theft, or the delivery of further malicious payloads. The flaw is a typical input‑validation weakness classified as CWE‑79.

All releases of the YOP Poll WordPress plugin through version 6.5.37 are affected. WordPress sites that install or enable this plugin without upgrading are vulnerable, regardless of WordPress core version.

The CVSS score of 7.1 classifies it as high severity. The EPSS score of less than 1% suggests a low likelihood of active exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. Attackers would target the plugin remotely by sending crafted requests to poll URLs that include user‑supplied data, leveraging the fact that the content is rendered in browsers. Based on the description, it is inferred that the flaw requires a victim’s browser to run the injected script, indicating an XSS threat, which could be reflected or stored depending on the input field used by the plugin.