The ays-pro Survey Maker plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. The flaw exists in the handling of the ‘ays_sections[5][questions][8][title]’ parameter, which lacks sufficient sanitization and escaping, enabling authenticated administrators to inject malicious scripts. This vulnerability affects all versions up to and including 5.1.3.3 and is limited to multi-site installations or those with unfiltered_html disabled. Exploitation could lead to script execution in users' browsers when they view the injected pages. The CVSS 3.1 base score is 5.5, reflecting medium impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch available at this time.

An authenticated attacker with administrator privileges can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of affected pages. This can lead to partial compromise of confidentiality and integrity of user sessions or data within the affected WordPress environment. The vulnerability does not affect availability and requires high privileges and specific configuration (multi-site or unfiltered_html disabled) to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should limit access to trusted users only and consider disabling or removing the vulnerable plugin in multi-site environments or where unfiltered_html is disabled. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.