Survey Maker vulnerabilities

Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.

The Survey Maker plugin for WordPress versions 5.2.2.5 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.

The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.

The WordPress plugin Survey Maker is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to view all survey submissions.