YOP Poll
YOP Poll has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 16 are fixed as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2021 was the busiest year with 3 disclosures.
The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 10 of the records (63%). Other recurring categories include Concurrent Execution Using Shared Resource With Improper Synchronization, Guessable CAPTCHA.
Every one of the 16 issues recorded for YOP Poll has a vendor fix available, so running the current release closes all known holes.
14 independent researchers contributed these findings, most of them (2) reported by Vishnupriya Ilango. YOP Poll is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-85682YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
Read the full analysisVulnerability Records
YOP Poll
Author
YOP
YOP Poll is back — completely rebuilt from the ground up. After more than a decade of powering polls on WordPress sites, YOP Poll has been rewritten from scratch using modern web technologies. The result is a faster, more secure, and dramatically easier-to-use plugin — without losing any of the flexibility that made YOP Poll the go-to polling solution for WordPress. Faster, end to end. The new admin interface responds instantly to your actions. Creating a poll, editing answers, switching templates, viewing results — everything happens in real time, with no full-page reloads slowing you down. More secure by design. Internal data handling has been modernized to follow current security best practices. Easier for everyone. The admin has been redesigned around how people actually build polls. Clear flows, sensible defaults, and fewer clicks to go from idea to published poll — whether you’re running a single quick poll or managing dozens of campaigns at once. Safe to upgrade. All your existing polls, votes, templates, and settings migrate automatically. Nothing to export, nothing to rebuild — just install the new version and pick up where you left off. Everything you can do with YOP Poll Run unlimited polls at the same time, with no artificial limits Schedule polls to start and end automatically — perfect for time-bound campaigns Choose between single-choice and multiple-choice questions Allow voters to add their own “Other” answers Sort answers in any order — exact, alphabetical, by votes, ascending, or descending Display results before voting, after voting, on a custom date, after the poll ends, or never Show results as numbers, percentages, or both Collect extra information from voters with custom fields (name, email, age, anything you need) Set who can vote: guests, registered users, or both Block voters by cookie, IP, or username Display polls anywhere with shortcodes, widgets, or by poll ID Show a random active poll, the latest poll, or any specific poll Browse a full archive of past polls with statistics View detailed logs of every vote, with sorting, search, and export Manage bans by email, username, or IP — globally or per poll Built-in protection against spam votes, including Cloudflare Turnstile support
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C