CVE-2023-2572

Summary

CVE-2023-2572 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Survey Maker WordPress plugin before version 3.4.7. This issue arises due to the plugin's failure to properly escape certain parameters before rendering them in HTML attributes. An attacker could exploit this flaw by injecting malicious scripts into forms, posing a significant risk to high privilege users, such as administrators, who could be tricked into opening the maliciously crafted forms. The outcome could range from session hijacking to full account takeover. It is recommended that users update their Survey Maker plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.