WordPress Plugin "Survey Maker" versions 5.1.7.7 and older harbour a Cross‑Site Scripting flaw that allows an attacker to inject and run arbitrary JavaScript when users view the survey. The vulnerability enables execution of malicious code, which can harvest cookies, hijack sessions, or perform other client‑side attacks against the visitor. A likely attack vector is a crafted survey URL or form field that delivers unsanitized user input to the browser, but this is inferred from the nature of the flaw and not explicitly stated in the description.

The affected system is the Survey Maker plugin developed by Ays Pro for WordPress. Versions 5.1.7.7 and any earlier releases are vulnerable and should be avoided until a patch is applied.

The CVSS score of 5.1 indicates a medium severity. The EPSS score of less than one percent implies that exploitation is expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because it enables arbitrary script execution, a malicious actor who can lure a user to the vulnerable survey can gain client‑side compromise. No vendor‑provided fix is listed, so the vulnerability remains exploitable until the plugin is updated.