CVE-2025-48095: Survey Maker Stored XSS Vulnerability

CVE-2025-48095 Overview

CVE-2025-48095 is a stored Cross-Site Scripting (XSS) vulnerability in the Ays Pro Survey Maker plugin for WordPress. The flaw affects all versions of survey-maker up to and including 5.1.8.8. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].

An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. Exploitation requires user interaction and crosses a trust boundary, allowing impact on components beyond the vulnerable plugin.

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions in the context of victim users, including WordPress administrators.

Affected Products

Ays Pro Survey Maker plugin for WordPress
All versions from n/a through 5.1.8.8
WordPress sites running the vulnerable survey-maker plugin

Discovery Timeline

2025-10-22 - CVE-2025-48095 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48095

Vulnerability Analysis

The vulnerability resides in the input handling logic of the Survey Maker plugin. User-supplied data is stored and later rendered into web pages without adequate sanitization or output encoding. As a result, attacker-controlled markup and script content persist in the database and execute when victims load affected pages.

Because the payload is stored, exploitation does not require crafted links or repeated attacker interaction. Any privileged user who views the poisoned survey content triggers the injected script. The scope change indicated by the CVSS vector means executed code can affect resources beyond the plugin, such as the WordPress admin session.

Root Cause

The root cause is missing or insufficient neutralization of special characters in survey-related fields before persistence and rendering. WordPress plugins typically must call sanitize_text_field(), wp_kses(), or esc_html() on user input. When these controls are absent, HTML and JavaScript flow into the DOM as executable content, matching the CWE-79 pattern.

Attack Vector

An attacker with high privileges on the WordPress site authenticates and submits crafted survey content containing JavaScript payloads. The payload is stored server-side. When an administrator or other user later views the survey in the dashboard or a public page, the browser parses and executes the injected script within the site's origin.

See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-48095

Indicators of Compromise

Survey records containing <script> tags, on*= event handlers, or javascript: URIs in stored fields
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing survey content
New or modified WordPress administrator accounts created shortly after survey content was viewed
HTML entities or encoded payloads such as <script> embedded in survey title, question, or answer fields

Detection Strategies

Query the WordPress database for Survey Maker tables and search stored fields for HTML tags and JavaScript keywords
Monitor WordPress wp_users and wp_options tables for unauthorized modifications following survey activity
Inspect web server access logs for POST requests to admin-ajax.php and Survey Maker endpoints containing script markers
Deploy Content Security Policy (CSP) reporting to surface script execution violations on pages rendering survey content

Monitoring Recommendations

Audit all accounts with permissions to create or edit surveys and review their recent activity
Enable WordPress activity logging to track changes to survey content, plugin settings, and user roles
Alert on browser session anomalies for administrators, including unexpected cookie access and API calls
Route WordPress and web server telemetry to a centralized analytics platform for correlation with authentication events

How to Mitigate CVE-2025-48095

Immediate Actions Required

Identify all WordPress sites running the Ays Pro Survey Maker plugin at version 5.1.8.8 or earlier
Update the survey-maker plugin to a version above 5.1.8.8 as soon as the vendor releases a patched build
Review and remove any suspicious survey content containing HTML or JavaScript payloads
Rotate credentials and invalidate active sessions for administrator accounts that may have viewed malicious content

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version and vendor advisory. Apply the patched release through the WordPress plugin manager or WP-CLI. Verify the installed version after upgrade.

Workarounds

Restrict survey creation and editing to a minimal set of trusted administrator accounts
Deploy a Web Application Firewall (WAF) rule to block requests containing script markup targeting Survey Maker endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and public pages
Temporarily disable the Survey Maker plugin on sites where an immediate patch cannot be applied

bash

# Update the Survey Maker plugin using WP-CLI
wp plugin update survey-maker

# Verify installed version is above 5.1.8.8
wp plugin get survey-maker --field=version

# Temporary mitigation: deactivate the plugin if patch is unavailable
wp plugin deactivate survey-maker