What is the CVSS score of CVE-2026-57361?

CVE-2026-57361 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Survey Maker are affected by CVE-2026-57361?

Survey Maker plugin by AYS Pro (versions 5.2.2.5 and earlier) contains a stored/reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious code that executes…

How to fix or mitigate CVE-2026-57361?

24 hours: Audit all WordPress installations to identify Survey Maker plugin presence and current version. 7 days: Disable the Survey Maker plugin across all sites where it is not essential; if required for operations, restrict access to trusted internal users only. 30 days: Monitor vendor (AYS Pro) for a patched version release and upgrade immediately upon availability; evaluate replacement survey plugins if timelines exceed organizational risk tolerance.

Survey Maker CVE-2026-57361

EUVD-2026-41360 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-r9g6-2f8j-qw6x

WordPress XSS Survey Maker Wordpress Plugin Ays Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS requiring victim interaction (UI:R); injected script escapes plugin scope (S:C) with limited but real confidentiality/integrity/availability impact via session hijacking.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:17 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

AnalysisAI

Stored/reflected cross-site scripting in the Survey Maker WordPress plugin (versions 5.2.2.5 and earlier by AYS Pro) lets unauthenticated remote attackers inject JavaScript that executes in a victim's browser after they interact with a crafted page or survey. The CVSS scope-change flag (S:C) indicates the injected script escapes the plugin's context to affect the wider WordPress site, potentially reaching authenticated admin sessions. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected software is Survey Maker (CPE cpe:2.3:a:ays_pro:survey_maker), a WordPress plugin from AYS Pro used to build surveys, polls, and quizzes on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input - likely survey submission fields or query parameters - is reflected or stored and rendered without proper output encoding or sanitization. Because the plugin runs inside the WordPress PHP application and emits HTML directly into rendered pages, unescaped input becomes active script in the DOM of any visitor or administrator viewing the affected output.

RemediationAI

No vendor-released patch version was identified in the provided data - the input only defines the vulnerable range (<= 5.2.2.5), so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-2-2-5-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for a release newer than 5.2.2.5 and upgrade to it as soon as one is confirmed available. Until a fixed version is applied, compensating controls include placing a Web Application Firewall or Patchstack's virtual patch in front of the site to filter XSS payloads in survey parameters (trade-off: rule tuning may cause false positives on legitimate rich input), restricting or disabling public/unauthenticated survey submission if the deployment allows it (trade-off: reduces plugin functionality), and deactivating the Survey Maker plugin entirely if surveys are non-essential (trade-off: removes the feature but eliminates the exposure). Enforcing a strict Content-Security-Policy that disallows inline script execution also reduces the impact of any injected payload.