Plugin inspection:

Responsive Poll

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Findings

  • Contains CSRF/XSS vulnerability
  • Uses mysql_real_escape_string() instead of $wpdb->prepare() in some places (admin/class-weblator-tables.php line 132, for example)
  • Likely vulnerable to SQL injection because this is inserted unescaped into SQL queries: mysql_real_escape_string($_GET[“orderby“]) (admin/class-weblator-tables.php line 135 and 136)

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Failure criteria

  • Unsafe generation of PHP code
  • Unsafe request processing
  • Lack of proper output escaping

Read more about our failure criteria.