Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question
Advisory: The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Read more about this vulnerability: https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3c22a2-b766-419c-a481-48e6a73b084c?source=api-prod
Please note: The EntreBase Trust and Safety team curates information from industry leading vulnerability databases with identified threats and vulnerabilities known as Threat Intelligence. Our database is continuously updated, maintained, and populated by our experienced vulnerability researchers through in-house and open-source vulnerability research, and by monitoring varying open-sources to capture all publicly available threat and vulnerability information and adding additional context where we can.
Did you find this article helpful? Please share and let us know as we would love to hear from you. As always, we’re here if you need someone to assist: Let’s Talk!
