Read the docs

Ays Pro

Records146All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high47CVSS 7.0–8.9

Exploited now

Ays Pro records in CISA KEV

No Ays Pro vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Poll Maker 20 records MEDIUM Quiz Maker 17 records HIGH Survey Maker 16 records HIGH Popup Box 10 records MEDIUM Photo Gallery 6 records MEDIUM Secure Copy Content Protection And Content Locking 5 records HIGH Chartify 2 records MEDIUM Chatgpt Assistant 2 records HIGH

Records

16 records in Survey Maker · all components

TI-2023-09325 CVE-2023-23490 · GHSA-rhcg-3p4c-647v

SQL injection in Survey Maker WordPress Plugin

Priority HIGH 79

The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02365 Published 2023-01-20 Fixed in 3.1.2 CWE-89
TI-2023-02404 CVE-2023-2572 · GHSA-xx4c-xhpg-hcw2

Survey Maker < 3.4.7 - Reflected XSS

Priority MEDIUM 60

The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-06-05 Fixed in 3.4.7
TI-2023-08872 CVE-2023-22697 · GHSA-3v7v-w4cq-gmpp

WordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerability

Priority MEDIUM 49

Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through 3.2.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0064 Published 2024-12-13 No fix listed CWE-862
TI-2021-06748 CVE-2021-24459 · GHSA-3wmq-8jfx-8qrm

Survey Maker < 1.5.6 - Authenticated Blind SQL Injections

Priority MEDIUM 41

The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01362 Published 2021-08-02 Fixed in 1.5.6 CWE-89
TI-2023-00036 CVE-2023-0038 · GHSA-9893-2v8q-6v9r

Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 39

The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and ou…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.008 Published 2023-01-03 No fix listed CWE-79
TI-2023-17858 CVE-2023-35764 · GHSA-mfh5-9vgh-ffpg

Insufficient verification of data authenticity in Ays Pro Survey Maker

Priority LOW 30

Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00263 Published 2024-04-03 Fixed in 4.1.0 CWE-345
TI-2023-17250 CVE-2023-34423 · GHSA-ph95-6589-h2hv

Cross-site scripting in Ays Pro Survey Maker

Priority LOW 27

Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2024-04-03 Fixed in 3.6.4 CWE-79
TI-2025-16547 CVE-2025-22664 · GHSA-pg65-86gh-q227

WordPress Survey Maker Plugin <= 5.1.3.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.3.5.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00249 Published 2025-02-04 No fix listed CWE-79
TI-2024-33859 CVE-2024-50426 · GHSA-7cjp-4xf4-wwrm

WordPress Survey Maker plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.0.2.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00276 Published 2024-10-29 No fix listed CWE-79
TI-2024-18597 CVE-2024-27996 · GHSA-23h2-xqvf-mj5r

WordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 4.0.5.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00336 Published 2024-03-19 No fix listed CWE-79
TI-2025-23372 CVE-2025-32275 · GHSA-9r3j-xmvw-9j69

WordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability

Priority LOW 24

Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through <= 5.1.6.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0033 Published 2025-04-10 No fix listed CWE-290
TI-2024-12546 CVE-2024-13505 · GHSA-fp6x-mq75-x6gh

Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question

Priority LOW 24

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitiza…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00258 Published 2025-01-26 No fix listed CWE-79
TI-2024-07870 CVE-2024-8488 · GHSA-7cfq-84qm-pqqw

Cross-site scripting in Ays Pro Survey Maker

Priority LOW 22

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0028 Published 2024-10-08 No fix listed CWE-79
TI-2024-03781 CVE-2024-4061 · GHSA-6fj9-cq25-9x7h

Survey Maker < 4.2.9 - Admin+ Stored XSS via Plugin Settings

Priority LOW 22

The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilter…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00422 Published 2024-05-21 Fixed in 4.2.9 CWE-79
Open these records in search →