Stored Cross-Site Scripting Vulnerability in Survey Anyplace Plugin for WordPress

CVE-2025-10196

What is CVE-2025-10196?

The Survey Anyplace plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'surveyanyplace_embed' shortcode. This issue arises from insufficient input sanitization and output escaping of user-supplied attributes, affecting all versions up to and including 1.0.0. Authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts may execute whenever a visitor accesses an affected page, posing a risk to user data and website integrity.

References