Onyx Poll
Onyx Poll has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Onyx Poll has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Onyx Poll is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-5841ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Read the full analysisVulnerability Records

Onyx Poll
Author
andremacola
Onyx Poll creates lightweight polls with the WordPress REST API and JavaScript. ACF and ACF PRO are not required. Features Block editor integration with live preview, standard and Twitter styles. Shortcode, sidebar widget and automatic modal. Multiple polls per page, answer images and registered thumbnail sizes. Editable answer counters; the total is always their sum. Percentage, number or combined results, with an option to hide results until expiration. Voting intervals enforced on the server for signed browser sessions. Automatic expiration and an hourly WP-Cron task. Native administration with media selection and answer reordering. Dedicated tables for poll rules, answers and vote counters. Settings descriptions, help, cron execution status and WordPress Site Health integration. Optional permanent cleanup on uninstall; data is kept by default. Upgrading from the ACF version IMPORTANT: 2.0 is a major update with breaking changes to requirements and internal storage. Back up the full database and plugin files, and test the update on a staging copy before updating a production site. See the breaking changes below and the migration FAQ. Migration starts automatically on activation or on the next WordPress request after upgrading an already active plugin from 1.2.0 or an earlier ACF version. No manual export, import or reactivation is needed. The plugin creates {prefix}onyx_polls and {prefix}onyx_poll_answers and copies existing polls in resumable batches of 50 per request. A requested poll is imported on demand if its batch has not run yet, including the latest-poll shortcode and modal selection. IDs, titles, publication status, answer order and text, image references, individual vote counters, dates, voting limits, result preferences and global settings are preserved. Existing blocks, shortcodes and widgets keep working without editing post content. Each poll is imported in a database transaction; retrying migration does not overwrite already imported polls or votes received in 2.0. Legacy custom fields are kept for recovery and are not deleted by the update. New rules and votes are written only to the plugin tables. ACF is not required to run the plugin or migration; keep it installed if your theme or another plugin still needs it. The database user must be allowed to create the plugin tables. Breaking changes in 2.0 Minimum requirements are now WordPress 6.3 and PHP 7.4. Check the hosting environment before updating. Poll data moves from WordPress custom fields to the plugin tables. Custom templates, snippets or integrations that read or write ACF fields or onyx_poll_* post metadata must be adapted; those legacy fields stop receiving updates. The plugin’s existing shortcodes, block identifier, widget and public REST routes remain compatible. Total votes is now read-only and equals the sum of answer counters. A manually entered total that differed from that sum will change during migration; individual answer counters are preserved. Poll editing and settings use native plugin forms. Customizations that depend on ACF field registration, form markup or ACF-specific hooks must be reviewed. Downgrading to 1.2.0 does not copy new votes or edits back into legacy fields. Restoring an old backup also loses changes made after that backup. Plan rollback with a current database backup; do not use downgrade as a way to reverse migration.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C