The Survey Maker plugin for WordPress (ays-pro) contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-8488. This vulnerability exists due to improper neutralization of input during web page generation, specifically in survey fields. Authenticated users with administrator privileges can inject arbitrary web scripts that persist and execute when other users view the injected pages. The vulnerability affects multi-site installations or those with unfiltered_html disabled, across all versions up to and including 4.9.7. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. No patch or vendor advisory detailing remediation is currently provided.

An attacker with administrator-level access can exploit this vulnerability to inject persistent malicious scripts into survey pages. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions or data exposure limited to the scope of the injected script. The vulnerability does not impact availability and requires high privileges, limiting the attack surface. It affects multi-site WordPress environments or those with unfiltered_html disabled, which restricts the affected user base.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully control and audit users with administrator-level permissions and consider restricting access to the Survey Maker plugin in multi-site or unfiltered_html-disabled environments. Monitoring for suspicious script injections in survey content is advisable. Avoid granting unnecessary high-level privileges to reduce risk.