Technical impact
The CVE-2026-125813 vulnerability is a reflected Cross‑Site Scripting flaw caused by improper neutralization of input during web page generation in the Ays Pro Survey Maker plugin. An attacker can embed malicious script code that is reflected back to the victim through survey responses, allowing the attacker to execute arbitrary JavaScript in the context of the site. This defect is classified as CWE‑79 and can lead to session hijacking, cookie theft, defacement, or distribution of malware for every visitor that interacts with the vulnerable survey form.
Affected Systems
The flaw affects the Ays Pro Survey Maker plugin for WordPress, versions up through 5.2.4.3. Sites running any of these versions of the plugin expose the vulnerability. Administrators should check that no older plugin files remain on their servers.
Risk and Exploitability
The CVSS base score of 7.1 indicates a high severity reflected XSS vulnerability. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is reflected, meaning it can be triggered by an attacker supplying a crafted survey input that is reflected in the HTML response. Because the malicious script executes in the victim’s browser, the impact can include disclosure of sensitive site data, credential theft, and malicious code injection for every user accessing the affected survey. While the vulnerability is not currently publicly exploited, the lack of a known KEV entry does not reduce its potential risk.
