Cross-site Scripting Vulnerability in Ays Pro Survey Maker by WordPress
CVE-2026-125813

7.1HIGH

Key Information:

Vendor

WordPress
Status
Survey Maker
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125813?

Ays Pro Survey Maker is susceptible to a Cross-site Scripting (XSS) vulnerability that allows malicious actors to inject arbitrary scripts into web pages. When users interact with the compromised survey, their browsers may execute the payload, potentially leading to unauthorized data access and session hijacking. This vulnerability impacts versions from n/a up to 5.2.4.3, emphasizing the need for users to implement security best practices and monitor for updates.

Affected Version(s)

Survey Maker 0 <= 5.2.4.3

References

https://patchstack.com/database/wordpress/plugin/survey-m...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.