Published:2024/03/27  Last Updated:2024/03/27

JVN#51098626
Multiple vulnerabilities in WordPress Plugin "Survey Maker"

Overview

WordPress Plugin "Survey Maker" provided by AYS Pro Plugins contains multiple vulnerabilities.

Products Affected

CVE-2023-34423

  • Survey Maker versions prior to 3.6.4
CVE-2023-35764
  • Survey Maker versions prior to 4.1.0

Description

WordPress Plugin "Survey Maker" provided by AYS Pro Plugins contains multiple vulnerabilities listed below.

  • Stored cross-site scripting (CWE-79) - CVE-2023-34423
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3
  • Insufficient verification of data authenticity (CWE-345) - CVE-2023-35764
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score: 5.3
    CVSS v2 AV:N/AC:L/Au:N/C:N/I:P/A:N Base Score: 5.0

Impact

  • An arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege - CVE-2023-34423
  • A remote attacker may spoof an IP address when posting - CVE-2023-35764

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Vendor Status

Vendor Link
AYS Pro Plugins Survey Maker – Best WordPress Survey Plugin

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Atsuya Yoda of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2023-34423
CVE-2023-35764
JVN iPedia JVNDB-2024-000035