Medium severity · published Jan 3, 2023
CVE-2023-0038
Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Survey Maker · ays-pro
through 3.1.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0038
Exploit
https://plugins.trac.wordpress.org/browser/survey-maker/tags/3.1.4/public/partials/class-survey-maker-submissions-summary-shortcode.php?rev=2839688#L311
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a58fab-d4a3-4333-8495-e094ed85bb61?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a58fab-d4a3-4333-8495-e094ed85bb61
More from Survey Maker
9.8
CVE-2023-22697
WordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerability
8.8
CVE-2023-23490
The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json'…
8.8
CVE-2021-24459
Survey Maker < 1.5.6 - Authenticated Blind SQL Injections
7.1
CVE-2026-65565
WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability
7.1
CVE-2026-57361
WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability