What is the CVSS score of CVE-2026-65565?

CVE-2026-65565 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Survey Maker are affected by CVE-2026-65565?

Survey Maker WordPress plugin (versions ≤5.2.3.3) contains an unauthenticated cross-site scripting (XSS) vulnerability that permits attackers to inject malicious code into surveys, enabling session…

How to fix or mitigate CVE-2026-65565?

Within 24 hours: Identify all WordPress instances running Survey Maker plugin ≤5.2.3.3 and immediately deactivate the plugin; audit survey interaction logs for exploitation evidence. Within 7 days: Evaluate alternative survey solutions and implement Content Security Policy headers and Web Application Firewall rules to block XSS injection patterns site-wide. Within 30 days: Complete migration to a patched or hardened alternative survey plugin and resume survey functionality with security controls in place.

Survey Maker CVE-2026-65565

EUVD-2026-53986 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-g4gq-cg7r-jrv8

WordPress XSS Survey Maker Wordpress Plugin Ays Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS with required victim interaction and Changed scope; A:N assessed as no realistic availability impact from client-side script injection.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:51 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Survey Maker is a WordPress form/survey plugin developed by AYS Pro (CPE: cpe:2.3:a:ays_pro:survey_maker:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output escaping of user-controlled input before it is rendered in the browser DOM. The CVSS vector's PR:N confirms no authentication is required to submit the malicious payload, consistent with a reflected or stored XSS reachable via public survey submission endpoints. UI:R indicates the injected script only executes when a victim loads or interacts with the affected page - a classic reflected or stored XSS trigger model. The Changed scope (S:C) is standard for XSS, reflecting that the impact crosses from the server-side plugin boundary into the victim's browser security context.

RemediationAI

Update the Survey Maker plugin to a version higher than 5.2.3.3 via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or download the latest release from the WordPress.org plugin repository. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-2-3-3-cross-site-scripting-xss-vulnerability to confirm the exact patched release version, as the input data does not specify one. If immediate patching is not feasible, deactivate the Survey Maker plugin entirely to eliminate the attack surface - note this will take surveys offline. As a secondary compensating control, deploying a WAF rule targeting common XSS payloads in survey form parameters can reduce risk, though it may cause false positives on legitimate special-character input and should not replace patching. Restricting public survey access to authenticated users only (if supported by plugin configuration) would remove the unauthenticated attack vector.