The RS Survey plugin for WordPress contains an improper neutralization of input during web page generation, creating a reflected XSS vulnerability. An attacker could supply malicious script payloads that are reflected back into the browser, enabling arbitrary code execution, cookie theft, or site defacement. The weakness is identified as CWE‑79, indicating insufficient input validation and output encoding.

This flaw affects the RS Survey plugin by Richestsoft, version 1.0 and earlier. Sites that have installed any of these versions are at risk if the plugin is publicly accessible.

With a CVSS score of 7.1, the vulnerability is moderately high severity. Its EPSS score of less than 1% suggests a very low exploitation probability, and it is not listed in the CISA KEV catalog. Nevertheless, reflected XSS can be abused remotely via crafted URLs or form inputs that are echoed without proper sanitization. The likely attack vector is through reflected query string parameters or form fields that are rendered back to the user’s browser, allowing an attacker to execute code in the victim’s context.