WordPress wp-polls has 5 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2015-9352 | The wp-polls plugin before 2.72 for WordPress has SQL injection. | critical | 9.8 | <2.72 | 2.72 |
| CVE-2016-10936 | The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. | medium | 6.1 | <2.73.1 | 2.73.1 |
| CVE-2022-1581 | The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes | medium | 5.3 | <2.76.0 | 2.76.0 |
| CVE-2024-13426 | The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient | medium | 5.4 | <2.77.3 | 2.77.3 |
| CVE-2022-40130 | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. | medium | 4.3 | <2.77.0 | 2.77.0 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked