Improper neutralization of input allows malicious scripts to run in the victim’s browser, enabling session hijacking, credential theft, defacement, or other client‑side attacks. The flaw is a classic XSS vulnerability described by CWE‑79 and carries a CVSS score of 7.1, indicating a high impact on confidentiality, integrity, and availability of the website visitor. The description specifies that the vulnerability exists in all versions of the Modal Survey plugin up to and including 2.0.2.0.1.

The vulnerability affects the Pantherius Modal Survey WordPress plugin, any installation of the plugin with a version of 2.0.2.0.1 or earlier. The plugin is deployed on WordPress sites running the Modal Survey add‑on.

The CVSS score of 7.1 and an EPSS score below 1% indicate that while exploitation potential is significant, realistic attack likelihood is low. The plugin does not appear in the CISA KEV catalog, suggesting no known active exploitation. An attacker would need to craft a payload that is reflected or stored in the survey fields and entice a user to view the page. The attack vector is inferred to be remote, through the web interface, and would exploit client‑side input without proper escaping. The absence of an official fix means risk mitigation relies on updating the plugin or manually sanitizing input.