Description
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
Published: 2026-07-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Survey Maker plugin for WordPress, up to and including version 5.2.2.5, contains an unauthenticated cross‑site scripting flaw. When a visitor loads a survey page that incorporates a malicious payload, the script executes in the visitor’s browser. The flaw arises from an input‑validation oversight, identified as CWE‑79.

Affected Systems

WordPress installations that have the Survey Maker (Ays Pro:Survey) plugin installed at version 5.2.2.5 or earlier are affected; no other vendors or products are implicated.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate severity. Because authentication is not required, any visitor who can view a survey can trigger the injection. The EPSS score is low (<1 %), suggesting that widespread exploitation is not currently likely, and the flaw is not listed in the CISA KEV catalog. Nonetheless, client‑side script execution poses a serious security risk and should be remediated promptly.

Generated by OpenCVE AI on August 1, 2026 at 21:42 UTC.

Remediation

Vendor Solution

Update the WordPress Survey Maker Plugin to the latest available version (at least 5.2.2.6).

OpenCVE Recommended Actions

  • Update the Survey Maker plugin to version 5.2.2.6 or newer.
  • If an immediate update cannot be applied, deactivate the vulnerable plugin to prevent public exposure until the update is available.
  • Temporarily block access to survey URLs (for example, using .htaccess rules or WordPress conditional logic) until the plugin is updated, ensuring that only legitimate users can view the surveys.

Generated by OpenCVE AI on August 1, 2026 at 21:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Ays-pro
Ays-pro survey Maker
Wordpress
Wordpress wordpress
Vendors & Products Ays-pro
Ays-pro survey Maker
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
Title WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Ays-pro Survey Maker
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T19:45:39.467Z

Reserved: 2026-06-24T12:45:36.889Z

Link: CVE-2026-57361

cve-icon Vulnrichment

Updated: 2026-07-02T19:45:31.915Z

cve-icon NVD

Status : Deferred

Published: 2026-07-02T12:17:36.560

Modified: 2026-07-02T20:17:04.243

Link: CVE-2026-57361

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T21:45:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')