Survey Maker EUVD-2026-53986

Exploitation requires no authentication (PR:N per CVSS), meaning any remote attacker can submit the malicious payload to the Survey Maker plugin without logging in. The specific limiting condition is victim interaction (UI:R): a user - ideally one with elevated WordPress privileges - must load or interact with the page rendering the injected content for the script to execute. The target site must be running Survey Maker plugin version 5.2.3.3 or earlier on WordPress. The exact injection point (survey submission fields, URL parameters, or plugin shortcode output) is not confirmed from available data beyond the Patchstack report. Exploitation is blocked if: the Survey Maker plugin is deactivated, survey pages are restricted to authenticated users only, or a WAF strips XSS payloads before they reach the plugin.

The CVSS 7.1 score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a remotely exploitable, low-complexity vulnerability requiring no authentication, though victim interaction is a prerequisite (UI:R), which meaningfully limits opportunistic mass exploitation. The Changed scope elevates the score and indicates the attacker can affect the victim's browser session - enabling session hijacking or privilege escalation if an admin views the malicious survey. No EPSS data was provided, so statistical exploitation probability cannot be assessed. The absence of a KEV listing and no confirmed public POC suggests this has not yet seen mass exploitation, but the low attack complexity makes exploitation accessible once a POC exists. Real-world risk is highest on WordPress deployments where surveys are publicly accessible and admin users are likely to preview or moderate survey responses. The A:L availability rating from the provided CVSS is atypical for XSS and may reflect client-side script-induced page disruption; defenders should weight C:L and I:L as the primary impacts.

An attacker identifies a WordPress site running Survey Maker <= 5.2.3.3 and injects a JavaScript payload into a vulnerable survey input field or crafts a malicious URL that causes the plugin to reflect unsanitized content. The attacker then lures an authenticated WordPress administrator - for example via a phishing email with a survey preview link - into loading the page, upon which the script executes in the admin's browser, exfiltrating their session cookie or silently creating a new admin account. No public POC has been identified at time of analysis, but AC:L indicates the exploit technique is straightforward to develop.