Stored Cross-Site Scripting Vulnerability in Survey Maker Plugin for WordPress

CVE-2024-13505

What is CVE-2024-13505?

The Survey Maker plugin for WordPress is exposed to a vulnerability that allows stored cross-site scripting (XSS) attacks due to inadequate input sanitization. This vulnerability exists in the 'ays_sections[5][questions][8][title]' parameter, which can be exploited by authenticated users with administrator-level privileges. Attackers can inject arbitrary web scripts that execute on pages visited by users, posing a significant security risk, especially in multi-site environments where unfiltered HTML is disabled.

References