Medium severity · published Apr 3, 2024
CVE-2023-34423
Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Survey Maker · AYS Pro Plugins
prior to 3.6.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-34423
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-34423
Third Party Advisory
https://jvn.jp/en/jp/JVN51098626/
Product
https://wordpress.org/plugins/survey-maker/
More from Survey Maker
5.3
CVE-2023-35764
Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting