Description
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
Published: 2026-07-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Survey Maker plugin for WordPress, up to and including version 5.2.2.5, contains an unauthenticated cross‑site scripting flaw that permits the injection of arbitrary JavaScript into survey pages. When a visitor loads a survey page that includes a malicious payload, the script runs in the victim’s browser. The flaw originates from an input validation oversight (CWE‑79).

Affected Systems

WordPress installations that have the Survey Maker (Ays Pro:Survey) plugin installed at version 5.2.2.5 or earlier are affected; no other vendors or products are implicated.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate severity. Because authentication is not required, any visitor who can view a survey can trigger the injection. The EPSS score is low (<1 %), suggesting that widespread exploitation is not currently likely, and the flaw is not listed in the CISA KEV catalog. Nonetheless, client‑side script execution poses a serious security risk and should be remediated promptly.

Generated by OpenCVE AI on July 21, 2026 at 11:48 UTC.

Remediation

Vendor Solution

Update the WordPress Survey Maker Plugin to the latest available version (at least 5.2.2.6).

OpenCVE Recommended Actions

  • Update the Survey Maker plugin to version 5.2.2.6 or newer.
  • If an immediate update cannot be applied, deactivate the vulnerable plugin to prevent public exposure until the update is available.
  • Temporarily block access to survey URLs (for example, using .htaccess rules or WordPress conditional logic) until the plugin is updated, ensuring that only legitimate users can view the surveys.

Generated by OpenCVE AI on July 21, 2026 at 11:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Ays-pro
Ays-pro survey Maker
Wordpress
Wordpress wordpress
Vendors & Products Ays-pro
Ays-pro survey Maker
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
Title WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Ays-pro Survey Maker
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T19:45:39.467Z

Reserved: 2026-06-24T12:45:36.889Z

Link: CVE-2026-57361

cve-icon Vulnrichment

Updated: 2026-07-02T19:45:31.915Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:00:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')