The vulnerability manifests as a stored XSS flaw caused by insufficient sanitization and escaping of user‑supplied attributes in the 'questionpro' shortcode. When an authenticated user with Contributor or higher privileges embeds malicious code via these attributes, the code is saved to the database and executed whenever any user visits the injected survey page. This flaw directly exploits CWE‑79 and can lead to session hijacking, defacement, or theft of sensitive data from end users who load the affected page.

All installations of the QuestionPro Surveys WordPress plugin up to and including version 1.0. The affected component is the plugin’s handling of shortcode attributes within the WordPress environment.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker must first obtain Contributor‑level or higher access to a site running the vulnerable plugin, after which they can inject persistent malicious script via the shortcode attributes. If successful, the code will execute in the browsers of any visitor to the affected survey page, potentially exposing credentials, session cookies, or other confidential information. The attack surface is constrained to sites that have deployed the vulnerable plugin version and allowed contributors to edit shortcodes.