# Advanced Poll 6.x versions – XSS Vulnerability — Liran Tal

Disclosing a Cross-site Scripting vulnerability in the Advanced Poll module for Drupal.

Canonical: https://lirantal.com/blog/2013-10-28

![Cover artwork for Advanced Poll 6.x versions – XSS Vulnerability](/_astro/photo-1468956398224-6d6f66e22c35.BePqp3CW_Zj88Tk.jpg)

During the weekend I discovered an XSS issue with the [Advanced Poll](https://drupal.org/project/advpoll) module. I’ve made sure to provide a [patch](https://drupal.org/files/advanced_poll-xss_issue-2121459-1.patch) and [submit](https://drupal.org/node/2121459#comment-8004705) this to the issue queue.

I have actually submitted a few other SAs in the past, [one of them](http://security.drupal.org/node/75123) was for the [nice\_dash](http://drupal.org/project/nice_dash) module, which aims to provide a dashboard interface for Drupal administrators, but unfortunately it [wasn’t yet merged to source control](https://drupal.org/node/1650720).

```
Drupal Security Advistory – XSS vulnerability in Advanced Poll module versions 6.x-3.x and prior
Project: Advanced Poll (third-party module)

Version: 6.x-3.x and earlier

Date: 2013-10-25

Security risk: Highly critical

Exploitable from: Remote

Vulnerability: Cross Site Scripting

This module enables you to create advanced types of polls, such as binary and ranking poll, as the module calls them. The module did not sufficiently filter poll question titles for malicious JavaScript. This vulnerability is mitigated by the fact that an attacker must have permission to create or edit polls.

Versions affected
Advanced Poll 6.x-3.x and all prior versions

Solution
Apply the patch

Reported by
Liran Tal <liran.tal@gmail.com>

Fixed by
Liran Tal  <liran.tal@gmail.com>
```

## More writing

[All writing](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)