The SurveyFunnel – Survey Plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'surveyfunnel_lite_survey' shortcode does not adequately sanitize or escape user-supplied attributes, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.1.5. There is no indication of known exploits in the wild or available patches at this time.

An authenticated attacker with contributor-level privileges or higher can exploit this vulnerability to inject and store malicious scripts within pages using the vulnerable shortcode. When other users access these pages, the scripts execute in their browsers, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires user interaction (page access) to trigger. The CVSS 3.1 base score is 6.4, reflecting a medium severity level with network attack vector, low attack complexity, and no user interaction required for exploitation once the malicious content is stored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the 'surveyfunnel_lite_survey' shortcode if feasible. Monitor official wpeka-club communications for updates regarding patches or mitigations.