YOP Poll

YOP Poll has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2021 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 10 of the records (67%). Other recurring categories include Guessable CAPTCHA, Missing Authorization.

Every one of the 15 issues recorded for YOP Poll has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (2) reported by Vishnupriya Ilango. YOP Poll is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

15

Get automatic notifications for all YOP Poll vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2025-62040

YOP Poll <= 6.5.37 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

15 records
YOP Poll banner
Latestv7.0.10

YOP Poll

YOP

Author

YOP

4.4(451)
88/100
Last Updated
2026-08-31 (13d ago)
Active Installs
10,000+
Downloads
1,313,528
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2012-11-14 (14y ago)

YOP Poll is back — completely rebuilt from the ground up. After more than a decade of powering polls on WordPress sites, YOP Poll has been rewritten from scratch using modern web technologies. The result is a faster, more secure, and dramatically easier-to-use plugin — without losing any of the flexibility that made YOP Poll the go-to polling solution for WordPress. Faster, end to end. The new admin interface responds instantly to your actions. Creating a poll, editing answers, switching templates, viewing results — everything happens in real time, with no full-page reloads slowing you down. More secure by design. Internal data handling has been modernized to follow current security best practices. Easier for everyone. The admin has been redesigned around how people actually build polls. Clear flows, sensible defaults, and fewer clicks to go from idea to published poll — whether you’re running a single quick poll or managing dozens of campaigns at once. Safe to upgrade. All your existing polls, votes, templates, and settings migrate automatically. Nothing to export, nothing to rebuild — just install the new version and pick up where you left off. Everything you can do with YOP Poll Run unlimited polls at the same time, with no artificial limits Schedule polls to start and end automatically — perfect for time-bound campaigns Choose between single-choice and multiple-choice questions Allow voters to add their own “Other” answers Sort answers in any order — exact, alphabetical, by votes, ascending, or descending Display results before voting, after voting, on a custom date, after the poll ends, or never Show results as numbers, percentages, or both Collect extra information from voters with custom fields (name, email, age, anything you need) Set who can vote: guests, registered users, or both Block voters by cookie, IP, or username Display polls anywhere with shortcodes, widgets, or by poll ID Show a random active poll, the latest poll, or any specific poll Browse a full archive of past polls with statistics View detailed logs of every vote, with sorting, search, and export Manage bans by email, username, or IP — globally or per poll Built-in protection against spam votes, including Cloudflare Turnstile support

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C