ACF Onyx Poll

ACF Onyx Poll has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for ACF Onyx Poll has a vendor fix available, so running the current release closes it.

All of these findings were reported by Peter Thaleikis. ACF Onyx Poll is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all ACF Onyx Poll vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-5841

ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

Read the full analysis

Vulnerability Records

1 records
ACF Onyx Poll banner
Latestv1.2.0

ACF Onyx Poll

andremacola

Author

andremacola

5.0(4)
100/100
Last Updated
2025-06-11 (1y ago)
Active Installs
70+
Downloads
6,355
Requires WP
4.7+
Requires PHP
7.0+
Tested up to
WP 6.8.8
Created
2020-05-26 (6y ago)

This plugin requires ADVANCED CUSTOM FIELD PRO installed. Plugin for polls based on regular WordPress and acf (advanced custom fields) functionalities using WP REST API and Javascript methods. The main goal of ACF Onyx Poll is to be totally free, lightweight and simple. No fancy, colorful and polluted options or donate screens. This plugin is based on Twitter poll cards style. Features ✔ Gutemberg Block with live preview ✔ Include poll with a shortcode (ommit the ID to get the latest poll) [onyx-poll id=XX class="left|right|full"] ✔ One click to vote ✔ Works with cache plugins ✔ Multiple polls per page ✔ Support for images ✔ Native widget for sidebar ✔ Multiple style options [onyx-poll class="twitter|standard"] ✔ Show poll in a modal ✔ Show poll results on widget after expired ✔ Highlight choosed choice in results area ✔ Limit vote by device or time ✔ Poll activation/expiration schedule ✔ Results in percentage, numbers or both ✔ Show/Hide results ✔ Customize css with css variables ✔ Disable all plugin CSS and use your own ✔ Custom columns on WordPress data table admin area ✔ Translations support Observations This plugin does not support Internet Explorer Browser. One of the goals of this plugin is to be js/css lightweight and jQuery free. ACF Onyx Poll register fields via php to be able to use WordPress translation functions for field labels. So you won’t be able to view/edit the fields inside ACF Custom Fields Settings. To enable a better/faster CRON you need to manually set your host cronjob to get https://domain.tld/wp-json/onyx/polls/cron endpoint or disable WP-Cron define('DISABLE_WP_CRON', true); inside your wp-config and manually create the cron in your host/server Option 1: To run every hour set the cron: 0 * * * * wget -q -O - https://domain.tld/wp-json/onyx/polls/cron > /dev/null 2>&1 Option 2: if you disable the default WP-Cron: 0 * * * * wget -q -O - https://domain.com/wp-cron.php?doing_wp_cron > /dev/null 2>&1

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C