Decryption key:
Modal Survey - Best WordPress Poll, Survey & Quiz Plugin v2.0.2.2.4 Nulled
2.0.2.2.4 - Security Release (2026-06-27)
Security Fixes (internal audit):
- Critical: Added current_user_can('manage_options') capability check to manual plugin updater; previously any WP user could trigger a plugin overwrite.
- Critical: Removed print_r($this->temp_path) debug statement disclosing the absolute server filesystem path on the Update admin page.
- Critical: Added version downgrade protection to manual updater; uploading an older plugin version is now rejected.
- Security: Added esc_html() around version strings and esc_html() around changelog content read from uploaded ZIP in the updater.
- Security: Changed throw_error() to use wp_kses_post() instead of raw echo.
- Security: Added ['allowed_classes' => false] + is_array() guard to all unserialize() calls on participant .custom field data in settings_participants.php, settings.php (send_admin_email, send_autoresponse), and all four export modules (csv, xls, txt, xml).
- Security: Added wp_verify_nonce() CSRF protection to all three participant delete operations (delete_samesession, delete_incomplete, bulk delete_participants).
- Security: Escaped survey name with esc_html() in settings_savedforms.php survey title output.
- Security: Wrapped all custom-field configuration properties ($cf->id, $cf->name, $cf->warning, $cf->minlength, $cf->position) with esc_attr() in the survey editor.
- Security: Replaced plugin_dir_path() server path disclosure in import error message with a safe relative path.