Stored Cross-Site Scripting in Survey Maker WordPress Plugin
CVE-2023-0038

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Survey Maker – Best WordPress Survey Plugin
Vendor
CVE Published:
3 January 2023

Summary

The Survey Maker plugin for WordPress has a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts via injected code in survey answers. This occurs due to a lack of sufficient input sanitization and output escaping in versions up to and including 3.1.3. When users submit quizzes, attackers can exploit this weakness, causing malicious scripts to run anytime someone accesses the submissions page, potentially compromising user data and site integrity.

Affected Version(s)

Survey Maker – Best WordPress Survey Plugin * <= 3.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/survey-maker/t...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
.