Ays-pro Survey Maker vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ays-pro Survey Maker: 8 record(s), with affected versions and fixes.
CVE-2026-65565
High · 7.1
CWE-79 Aug 6, 2026
WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
CVE-2026-57361
High · 7.1
CWE-79 Jul 2, 2026
WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
CVE-2026-26370
Medium · 6.1
CWE-79 Feb 20, 2026
Cross-site Scripting (XSS) in Ays-pro Survey Maker
WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVE-2025-64276
Medium · 6.5
CWE-862 Nov 13, 2025
WordPress Survey Maker plugin <= 5.1.9.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through <= 5.1.9.4.
CVE-2025-12891
Medium · 5.3
CWE-862 Nov 13, 2025
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure
The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to view all survey submissions.
CVE-2025-12892
Medium · 5.3
CWE-862 Nov 13, 2025
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update
The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.
CVE-2025-48098
High · 7.1
CWE-79 Oct 22, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
CVE-2025-48095
Medium · 5.9
CWE-79 Oct 22, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.