vulnerabilities found

User input is not sanitized. Poll results are shown without escaping html characters and by modifying the value of a question before voting a user is able to insert html, javascript or any code. Also, when you click “see results” a post request is made to the server sending unsanitized data such as the poll id, e.g: CP_Polls_loadresults=1&CP_Polls_id=3, leading to sql injection. hope you fix that!.

https://ww.wp.xz.cn/plugins/cp-polls/