Survey Maker CVE-2026-57361

Exploitation requires a victim to interact with attacker-controlled content - per CVSS UI:R, the target must load a crafted link, submit through or view a malicious survey, or render a page containing the injected payload; the attack does not fire autonomously. The exact injection point is not specified in the provided data beyond CWE-79 in Survey Maker <= 5.2.2.5, but no authentication is needed on the attacker's side (PR:N), so any unauthenticated remote party can deliver the payload against a default installation of the plugin. The primary limiting factors are the mandatory user interaction and the requirement that the Survey Maker plugin (<= 5.2.2.5) be installed and its vulnerable survey rendering path be reachable by the target audience; maximum impact additionally depends on the victim being a privileged (admin) user for session-based site takeover.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes network-reachable, low-complexity exploitation with no privileges required, but it hinges on user interaction (UI:R) - a victim must load the malicious content, which is the standard limiter for XSS. The scope change (S:C) and the low-but-present C/I/A impacts reflect that script executing in an admin's browser can pivot to site takeover, which is why this rates High rather than Medium despite only 'Low' individual impacts. No EPSS score, KEV status, POC, or SSVC data was supplied, so real-world exploitation probability cannot be quantified from the input; the absence of a KEV listing and any published exploit suggests this is a disclosed-but-not-yet-weaponized finding rather than an active campaign. Net assessment: a credible, patch-worthy priority for sites running this plugin, but not an emergency in the absence of exploitation signals - treat as elevated routine patching.

An attacker crafts a URL or survey input containing a malicious JavaScript payload and lures a site visitor or administrator into loading it (UI:R). When the unescaped input is rendered, the script runs in the victim's browser session; if the victim is a logged-in administrator, the attacker can hijack the session, create rogue admin accounts, or inject site-wide content. No public proof-of-concept was identified at time of analysis.