Multiple vulnerabilities have discovered in the Wordpress Poll plugin for WordPress, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via the "poll_name" and "poll_question" POST parameters to wp-admin/admin-ajax.php (when "action" is set to "save_poll") is not properly sanitised before being stored and returned to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerabilities are confirmed in version 33.5. Prior versions may also be affected.

Solution
Update to version 33.6.

Provided and/or discovered by
The vendor credits Ryan Satterfield.

Changelog
Further details available to Secunia VIM customers

Original Advisory
WordPress Poll:
http://wordpress.org/extend/plugins/cardoza-wordpress-poll/changelog/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers