Security readout for executives and security teams
Plain-English summary
A flaw in the Ays Pro Survey Maker WordPress plugin (versions up to and including 5.1.8.8) lets a privileged user save malicious scripts that run in another visitor's browser when the survey is viewed. The impact is moderate and contained, but it can be used to hijack sessions, deface content, or trick users on affected sites.
Executive priority
Treat as a moderate, scheduled-patching item rather than an emergency. Business impact is limited unless attackers already hold privileged WordPress accounts, but stored XSS on customer-facing surveys can damage trust and aid phishing, so update on the next maintenance window.
Technical view
CVE-2025-48095 is a Stored Cross-Site Scripting (CWE-79) issue in the Survey Maker plugin for WordPress through 5.1.8.8. CVSS 3.1 base score is 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L), indicating a network-reachable attack requiring high privileges and victim interaction, with a scope change and limited CIA impact across components.
Likely exposure
Limited to WordPress sites running the Ays Pro Survey Maker plugin at version 5.1.8.8 or earlier. Exposure expands when administrative or editor-level accounts are shared, weakly protected, or assigned broadly. Public-facing sites that allow contributor-tier survey authoring face the greatest practical risk.
Exploitation context
No public evidence of active exploitation and the issue is not listed in CISA KEV. Exploitation requires an authenticated user with high privileges to inject script content, plus a victim who later interacts with the rendered survey. Sources cite Patchstack's vulnerability database; no in-the-wild campaigns are reported in the bundle.
Researcher notes
Stored XSS with PR:H and UI:R limits opportunistic abuse, but the scope-changed vector means injected script can affect contexts beyond the vulnerable component. The bundle lists "versions: 0" with defaultStatus unaffected, which is ambiguous; rely on the Patchstack advisory wording ("through <= 5.1.8.8") and verify the fixed release directly with Ays Pro before declaring remediation complete.
Mitigation direction
- Inventory WordPress sites and identify any using Ays Pro Survey Maker at or below 5.1.8.8.
- Check the vendor and Patchstack advisory for a fixed release and upgrade promptly when available.
- Restrict and audit accounts holding survey authoring privileges; enforce MFA on admin roles.
- Place the site behind a WAF with XSS filtering rules until a patch is applied.
- If no fix is available, consider deactivating the plugin on internet-facing sites.
Validation and detection
- Confirm plugin presence and version via WordPress admin or wp-cli plugin list.
- Review survey configuration fields and stored content for unexpected HTML or script tags.
- Audit user roles and recent activity for unauthorized high-privilege account creation or use.
- Monitor web logs and browser CSP reports for anomalous script execution on survey pages.
- Recheck Patchstack and the CVE record for an updated fixed-version advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-48095 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L1.73.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.