WordPress CP Polls Persistent XSS via File Upload

WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2016-20066 is a persistent cross-site scripting vulnerability in WordPress CP Polls 1.0.8 that stems from inadequate sanitization of file uploads. Attackers exploit the plugin's file upload functionality to inject malicious scripts containing event handlers (such as onerror attributes) that execute arbitrary JavaScript when users view the compromised content. This vulnerability affects WordPress installations using the vulnerable plugin version, potentially compromising site visitors through credential theft, session hijacking, or malware distribution. The persistent nature of this XSS means the injected payload remains stored on the server, affecting all subsequent users who access the poisoned content—making it significantly more dangerous than reflected XSS variants.

Casky's 301 matching skills leverage Claude AI's extended reasoning to detect attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques by analyzing file upload behaviors and content injection attempts. Practitioners would observe Casky identifying suspicious file upload activities that bypass input validation, detecting script payloads embedded in uploaded files with executable event handlers, and correlating these patterns with known malicious JavaScript signatures. The platform's skill mapping would flag improper content-type handling, missing file extension validation, and inadequate output encoding as critical gaps. Security teams would see detailed findings highlighting the specific upload endpoints vulnerable to injection, the file types accepted without proper validation, and recommendations for implementing strict allowlist-based file handling and content security policies to prevent XSS execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20066.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2016-20066

Casky has 301 skills that investigate the attack patterns behind CVE-2016-20066. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn