CVE-2025-48095
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Survey Maker plugin (versions up to and including 5.1.8.8) contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. Malicious scripts can be stored and executed by users.
Risk Assessment
An attacker can inject scripts into surveys or plugin pages that execute in users' browsers, potentially leading to session data theft or other actions in the victim's context.
Recommendation
Update the Survey Maker plugin to a version newer than 5.1.8.8 as soon as it becomes available. Until then, consider restricting user content submission or disabling the plugin.
Other vulnerabilities in Survey Maker
See all- CVE-2026-65565High
Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.
- CVE-2026-57361High
The Survey Maker plugin for WordPress versions 5.2.2.5 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.
- CVE-2025-64276Medium
The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.
- CVE-2025-12891Medium
The WordPress plugin Survey Maker is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to view all survey submissions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS