Implemented as a stored XSS flaw in the SurveyFunnel shortcode, the vulnerability permits an authenticated user with at least contributor privileges to inject malicious JavaScript into pages that render the survey. When the malicious payload is displayed, it runs in the context of the visitor’s browser, enabling session hijacking, credential theft, or phishing. The weakness arises from improper sanitization of shortcode attributes—a classic input validation failure (CWE‑79).

The flaw affects any site running SurveyFunnel – Survey Plugin for WordPress up to and including version 1.1.5. Sites with this plugin installed and where contributors or higher‑privilege users can create or edit surveys are vulnerable.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not listed as a known exploited vulnerability by CISA. Exploitation requires web‑UI access with authenticated contributor or higher, so the attack surface is restricted to users with sufficient role permissions. Even with these constraints, the potential to compromise user sessions and deface content warrants immediate attention.