WordPress security by component

Survey Maker

Plugin description

Survey Maker creates surveys with customizable questions, response collection, result displays, and survey management features in WordPress.

Survey Maker (survey-maker) is a WordPress plugin with 24 published CVE records in this archive. The latest tracked vulnerability was published Aug 06, 2026; the highest published CVSS base score is 8.8.

Plugin slug: survey-maker

Latest vulnerability

CVE-2026-65565: Survey Maker permits unauthenticated cross-site scripting

An unauthenticated visitor can submit attacker-controlled content that Survey Maker 5.2.3.3 and earlier renders without sufficient output encoding.

PublishedAug 06, 2026

Known safe version5.2.3.4

Published vulnerabilities for survey-maker
		Safe version
Aug 06, 2026	CVE-2026-65565 Survey Maker permits unauthenticated cross-site scripting An unauthenticated visitor can submit attacker-controlled content that Survey Maker 5.2.3.3 and earlier renders without sufficient output encoding.	5.2.3.4	CVE7.1 NVDPending
Jul 02, 2026	CVE-2026-57361 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 5.2.2.5.	5.2.2.6	CVE7.1 NVDPending
Feb 20, 2026	CVE-2026-26370 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.1 NVDPending
Nov 13, 2025	CVE-2025-64276 Survey Maker: A security weakness Survey Maker is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Nov 13, 2025	CVE-2025-12891 Survey Maker: A security weakness Survey Maker is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Nov 13, 2025	CVE-2025-12892 Survey Maker: A security weakness Survey Maker is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 22, 2025	CVE-2025-48098 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVDPending
Oct 22, 2025	CVE-2025-48095 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Apr 10, 2025	CVE-2025-32275 Survey Maker: Privilege escalation or authentication bypass Survey Maker is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE4.3 NVD5.3
Feb 04, 2025	CVE-2025-22664 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Jan 26, 2025	CVE-2024-13505 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.5 NVD4.8
Dec 13, 2024	CVE-2023-22697 Survey Maker: A security weakness Survey Maker is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD9.8
Oct 29, 2024	CVE-2024-50426 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Oct 08, 2024	CVE-2024-8488 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4 NVD4.8
May 21, 2024	CVE-2024-4061 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Apr 03, 2024	CVE-2023-35764 Survey Maker: A security weakness Survey Maker is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Apr 03, 2024	CVE-2023-34423 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Mar 27, 2024	CVE-2024-29918 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD5.4
Mar 19, 2024	CVE-2024-27996 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Jun 05, 2023	CVE-2023-2572 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Jan 20, 2023	CVE-2023-23490 Survey Maker: SQL injection Survey Maker is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD8.8
Jan 03, 2023	CVE-2023-0038 "Survey Maker – Best WordPress Survey Plugin": Cross-site scripting "Survey Maker – Best WordPress Survey Plugin" is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVD6.1
Feb 21, 2022	CVE-2021-26256 Survey Maker: Cross-site scripting Survey Maker is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.7 NVD6.1
Aug 02, 2021	CVE-2021-24459 get_results() and get_items() functions in the Survey Maker: SQL injection get_results() and get_items() functions in the Survey Maker is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD8.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers