CVE-2023-0038 Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

What is CVE-2023-0038?

CVE-2023-0038 is a high-severity cross-site scripting vulnerability in ays-pro Survey Maker, published on 3 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.

Weakness: CWE-79

Which versions are affected by CVE-2023-0038?

It affects 1 product.

Products include Ays-Pro Survey Maker.

How do I fix CVE-2023-0038?

No fix has been published for CVE-2023-0038 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0038 being exploited?

There is no known exploitation of CVE-2023-0038 in the wild and no public exploit code.

Other vulnerabilities in ays-pro Survey Maker

• CVE-2023-23490 SQL injection in Survey Maker WordPress Plugin High 8.8
• CVE-2021-24459 Survey Maker < 1.5.6 - Authenticated Blind SQL Injections High 8.8
• CVE-2024-29918 WordPress Survey Maker plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2023-34423 Cross-site scripting in Survey Maker Medium 6.1
• CVE-2023-2572 Survey Maker < 3.4.7 - Reflected XSS Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9893-2v8q-6v9r.