Security Alert Summary
The WordPress plugin “Survey Maker” (versions 5.1.7.7 and prior) contains a cross-site scripting (XSS) vulnerability that may allow an attacker to execute arbitrary scripts in a user’s web browser when the vulnerability is triggered. This can expose users of pages or interfaces provided by the plugin to client-side attacks.
CVE Details
- CVE ID: CVE-2026-26370
- Affected component: WordPress Plugin “Survey Maker”
- Affected versions: 5.1.7.7 and prior
- Published: February 20, 2026 at 08:17:03 AM
- Last modified: February 20, 2026 at 01:49:47 PM
- CVSS v3.1: Not specified in the CVE entry
- CVSS v3.0: Base Score 6.1 (MEDIUM) — Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: REQUIRED
- Scope: CHANGED
- Confidentiality Impact: LOW; Integrity Impact: LOW; Availability Impact: NONE
- CVSS v4.0: Base Score 5.1 (MEDIUM) — Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Attack Requirements: NONE
- Privileges Required: NONE
- User Interaction: ACTIVE
- Vulnerability Confidentiality/Integrity/Availability primary impacts: declared as NONE with low sub-impact on confidentiality and integrity in the CVSS v4.0 data
- Authentication / Privileges / User Interaction (from CVSS data):
- Privileges required: NONE
- User interaction: REQUIRED or ACTIVE depending on metric set (CVSS v3.0 reports UI:R; CVSS v4.0 reports UI:A)
- Authentication requirements: none specified
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None (based on CVSS v3.0)
- CWE / Weakness ID: CWE-79 (Cross-site Scripting)
Technical Details
The CVE describes a cross-site scripting (XSS) vulnerability in the Survey Maker plugin. If exploited, the vulnerability allows an attacker to cause arbitrary script execution inside the context of a user’s browser when they access plugin-provided pages or functionality. The CVE entry states that arbitrary script may be executed in the user’s web browser but does not name specific functions, REST API endpoints, or exact input validation checks that are missing.
The CVE entry lists affected versions as “5.1.7.7 and prior.” The entry does not specify a fixed version or patch availability in the provided data.
How This Could Impact Your Website
Consider a site where the owner publishes surveys using the affected plugin. An external visitor or a contributor interacting with a survey page could be shown malicious script injected through the vulnerable component. That script could, for example, read data accessible in the visitor’s browser context (depending on what the plugin exposes) or perform actions the user can take in their session.
In a small organization this might involve the site owner, internal staff who manage content, and external contributors who submit survey content. If an attacker can cause script to run in the browser of an authenticated user with elevated privileges, there is increased risk that user-visible data (such as names or email addresses shown on survey or response pages) could be exposed or used to craft targeted phishing or social engineering attempts. Availability impact is not indicated by the CVE.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other accounts with content publishing rights.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce exposure.
- Monitor site activity and server logs for unusual behavior related to survey pages or plugin endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
