Improper neutralization of input during web page generation allows attackers to inject malicious scripts that are reflected in the browser. Based on the description, it is inferred that an attacker can craft a request that includes JavaScript code, which will be executed in the context of any user who visits the survey page, and that because the code runs with the permissions of the victim's browser, the attacker can steal session cookies, deface the site, or perform unauthorized actions on behalf of the user.

Bob Likert Survey Master, a WordPress plugin, is vulnerable in all releases from the first public version up to and including 0.8.0.1. Any WordPress site that has installed this plugin without updating to a newer release is impacted.

Based on the description, it is inferred that exploitation requires only a crafted URL or form input that is reflected back to the user, making it easy for a non‑privileged attacker to attack unsuspecting visitors who view a malicious link. The CVSS v3.1 score is 7.1, indicating a high potential for client‑side damage. The EPSS score is less than 1 %, suggesting that exploitation attempts are uncommon but still possible, and the vulnerability is not yet listed in CISA’s KEV catalog.