What’s Vulnerable › Vulnerabilities

CVE-2025-3880: Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-17 · updated 2026-06-17
• Weakness: CWE-863

Description

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.

Affected products

• assafp Quiz, Poll & Survey Maker by Opinion Stage: before 19.10.0 — fixed in 19.10.0

How to fix

Upgrade to a fixed version: assafp Quiz, Poll & Survey Maker by Opinion Stage 19.10.0. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/plugin.php
• https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/src/Modules/Admin.php
• https://plugins.trac.wordpress.org/changeset/3310848/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ba86268a-7bd6-40ed-9af6-29409245675d?source=cve

Get alerted when CVE-2025-3880 or the next vulnerability affects your stack