PT-2022-9722 · WordPress · Survey Maker

Ngo Van + 1 · Published 2022-02-21 · Updated 2022-02-28 · CVE-2021-26256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Survey Maker WordPress plugin versions <= 2.0.6

Description The issue is related to an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This type of vulnerability allows attackers to inject malicious scripts into content from otherwise trusted websites, which are then executed by users' browsers.

Recommendations For Survey Maker WordPress plugin versions <= 2.0.6, update to a version greater than 2.0.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-26256

Affected Products

Survey Maker

References · 5

• 🔥 https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-2-0-6-unauthenticated-stored-cross-site-scripting-xss-vulnerability · Exploit
• https://wordpress.org/plugins/survey-maker/#developers · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26256 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26256 · Vendor Advisory
• https://t.me/cibsecurity/37871 · Telegram Post