CVE-2023-2572
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Risk Assessment
An attacker can lure an administrator into clicking a crafted link, executing malicious script in their session and potentially taking over the account.
Recommendation
Update the Survey Maker plugin to version 3.4.7 or later. Implement output escaping.
Other vulnerabilities in Survey Maker
See all- CVE-2026-65565High
Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.
- CVE-2026-57361High
The Survey Maker plugin for WordPress versions 5.2.2.5 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.
- CVE-2025-64276Medium
The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.
- CVE-2025-12891Medium
The WordPress plugin Survey Maker is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to view all survey submissions.
- CVE-2025-48095Medium
The Survey Maker plugin (versions up to and including 5.1.8.8) contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. Malicious scripts can be stored and executed by users.
Original NVD description (English source)
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Vulnerability data from NVD (NIST) · CISA KEV · EPSS