The Survey plugin for WordPress suffers from a stored cross‑site scripting flaw in drivers up to version 1.1, where input in the plugin’s admin settings is not properly sanitized or escaped. An attacker with administrator or higher privileges can embed arbitrary JavaScript into the plugin’s configuration, leading to script execution whenever any user views the edited page. This compromises both confidentiality and integrity of the affected site, as injected scripts can be used to steal session tokens, deface content, or perform other malicious actions.

WordPress installations running the Survey plugin version 1.1 or any earlier release are impacted. The vulnerability is limited to multisite networks and applies only when the WordPress "unfiltered_html" content filter is disabled, which is a common skip‑filter configuration in many multisite setups.

With a CVSS score of 4.4 the flaw carries a moderate risk rating. The EPSS score is not provided, and the vulnerability is not catalogued in CISA’s KEV list, suggesting that exploitation is relatively uncommon. Attackers must first acquire administrator credentials on the site; once authorized, the flaw allows persistent script injection that will affect all visitors to pages using the compromised plugin settings.