Democracy Poll

Democracy Poll has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2024; all 3 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2017 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 3 issues recorded for Democracy Poll has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by thiennv. Democracy Poll is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Democracy Poll vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2017-18521

Democracy Poll <= 5.3.6 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

3 records
Plugin Profile
Latestv6.5.0

Democracy Poll

Timur Kamaev

Author

Timur Kamaev

4.6(86)
92/100
Last Updated
2026-07-22 (2mo ago)
Active Installs
7,000+
Downloads
215,756
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2015-02-02 (12y ago)

This plugin provides an intuitive and powerful system for creating polls, with features such as: Customizable single-choice and multiple-choice voting Optional custom answers submitted by visitors Poll end dates Optional restriction of voting to registered users Multiple poll designs And more — see the changelog for details Democracy Poll is compatible with major cache plugins, including W3 Total Cache, WP Super Cache, Wordfence, Quick Cache, and others. Designed for ease of use and performance, it offers: A “Quick Edit” button for admins, shown directly above a poll A plugin menu in the admin toolbar Inline poll CSS Conditional JavaScript loading only when a poll is rendered And more — check the changelog for details More Info Democracy Poll is a modern version of the original, well-regarded plugin by the same name. Andrew Sutherland introduced the original plugin in 2006, including the innovative ability for visitors to add their own answers. This version retains the name and core idea but has been completely rewritten. Key features: Create new polls Cache plugin compatibility (e.g. W3 Total Cache, WP Super Cache) Allow visitors to add their own answers Multiple-choice voting support Automatic poll closing after a specified end date Display random polls Restrict voting to registered users (optional) Quick poll editing for administrators Edit vote counts Allow users to change their votes Voter tracking via IP address, cookies, or WordPress user ID, with optional vote clearing Embed polls in posts via [democracy] shortcode (visual editor button available) Widget support (optional) Admin bar menu for easy access (optional) Load front-end assets only when a poll is rendered Add custom notes under polls Customize designs via CSS themes Multisite support has been available since version 5.2.4. Documentation See the complete Democracy Poll documentation for setup instructions, user guides, shortcode reference, and developer integration points. Usage Widget Go to WP Admin → Appearance → Widgets and add the Democracy Poll widget Place it in a sidebar Configure settings Done Template Code In your theme file (e.g. sidebar.php), add: <?php if ( function_exists( 'democracy_poll' ) ) { ?> <div class="sidebar-section"> <h2>Polls</h2> <div class="my-poll"> <?php democracy_poll(); ?> </div> </div> <?php } ?> To show a specific poll: <?php democracy_poll( 3 ); ?> (replace 3 with your poll ID) To embed a specific poll in a post, use [democracy id="2"] shortcode. To embed a random poll in a post, use [democracy] shortcode. Poll Archive To show the poll archive: <?php democracy_archives( [ 'title_markup' => '<h2>{question}</h2>' ] ); ?>

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C