Ays-Pro
48 CVEs across 27 Ays-Pro products. Browse Ays-Pro vulnerabilities, severities, and proof-of-concept exploits.
Ays-Pro products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8995 | Medium | 4.3 | 2026-05-29 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and includin… |
CVE-2026-6817 | Medium | 5.8 | 2026-05-02 | The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6… |
CVE-2025-15611 | Medium | 5.4 | 2026-04-07 | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauth… |
CVE-2026-1336 | Medium | 5.3 | 2026-03-03 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capa… |
CVE-2026-2367 | Medium | 6.4 | 2026-02-25 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode… |
CVE-2026-2384 | Medium | 6.4 | 2026-02-20 | The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including… |
CVE-2026-1320 | High | 7.2 | 2026-02-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header… |
CVE-2026-1165 | Medium | 4.3 | 2026-01-31 | The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce imple… |
CVE-2025-14156 | Critical | 9.8 | 2025-12-15 | The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the… |
CVE-2025-14454 | Medium | 4.3 | 2025-12-13 | The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-14442 | Medium | 5.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV file… |
CVE-2025-14159 | Medium | 4.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4… |
CVE-2025-67595 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a thro… |
CVE-2025-13685 | Medium | 4.3 | 2025-12-02 | The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing n… |
CVE-2025-13381 | Medium | 5.3 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ay… |
CVE-2025-13378 | Medium | 6.5 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-12426 | Medium | 5.3 | 2025-11-19 | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin e… |
CVE-2025-12620 | Medium | 4.9 | 2025-11-13 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the ‘filterbyauthor’ parameter in a… |
CVE-2025-12891 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endp… |
CVE-2025-12892 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() fu… |
CVE-2025-11171 | Medium | 5.3 | 2025-10-08 | The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9… |
CVE-2025-58015 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Da… |
CVE-2025-58014 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a thro… |
CVE-2025-10042 | Medium | 5.9 | 2025-09-17 | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient es… |
CVE-2024-12575 | Medium | 5.3 | 2025-08-16 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and includi… |
CVE-2024-9599 | Medium | 5.4 | 2025-05-15 | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-8617 | Medium | 4.8 | 2025-05-15 | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perfo… |
CVE-2025-47545 | Medium | 5.3 | 2025-05-07 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Ays Pro Poll Maker poll-maker allows Leveraging Ra… |
CVE-2025-24577 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-32275 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through… |
CVE-2025-30774 | High | 8.2 | 2025-04-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker quiz-maker allows SQL Injection.This i… |
CVE-2024-13602 | Medium | 4.8 | 2025-03-16 | The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-1404 | Medium | 5.3 | 2025-03-01 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2025-26971 | High | 7.6 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection… |
CVE-2025-22664 | Medium | 5.9 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This… |
CVE-2024-13505 | Medium | 5.5 | 2025-01-26 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up… |
CVE-2024-10628 | High | 7.5 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including… |
CVE-2024-56277 | Medium | 5.3 | 2025-01-21 | Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5. |
CVE-2024-56295 | Medium | 6.5 | 2025-01-15 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-45766 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-22697 | Medium | 5.3 | 2024-12-13 | Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2023-50904 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-12115 | Medium | 4.3 | 2024-12-07 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-11458 | Medium | 6.1 | 2024-11-28 | The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter in all versions up to, and including… |
CVE-2024-10861 | Medium | 5.3 | 2024-11-16 | The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-10571 | Critical | 9.8 | 2024-11-14 | The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' p… |
CVE-2024-9874 | Medium | 4.9 | 2024-11-09 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all v… |
CVE-2024-50426 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This… |
CVE-2024-9475 | Medium | 4.9 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versi… |
CVE-2024-9462 | Medium | 5.5 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions… |
CVE-2024-8488 | Medium | 4.4 | 2024-10-08 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insuffi… |
CVE-2024-7714 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to dis… |
CVE-2024-7713 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain… |
CVE-2024-6889 | Medium | 4.8 | 2024-09-04 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6888 | Medium | 4.8 | 2024-09-04 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6138 | Medium | 4.8 | 2024-07-11 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-6028 | Critical | 9.8 | 2024-06-25 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 d… |
CVE-2024-4061 | Medium | 4.8 | 2024-05-21 | The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-3897 | Medium | 5.3 | 2024-05-02 | The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_c… |
CVE-2024-3601 | Medium | 5.3 | 2024-05-02 | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll… |
CVE-2023-23985 | Low | 3.7 | 2024-04-24 | Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4. |
CVE-2024-3600 | High | 7.2 | 2024-04-19 | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll… |
CVE-2023-35764 | Medium | 5.3 | 2024-04-03 | Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postin… |
CVE-2023-34423 | Medium | 6.1 | 2024-04-03 | Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-29918 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Reflected XSS.This… |
CVE-2024-27996 | Medium | 5.9 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This iss… |
CVE-2023-6591 | Medium | 4.8 | 2024-02-12 | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-47526 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allo… |
CVE-2024-1079 | Medium | 5.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all ve… |
CVE-2024-1078 | Medium | 4.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_start() and add_quest… |
CVE-2024-22027 | Medium | 6.5 | 2024-01-12 | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (… |
CVE-2023-6166 | Medium | 6.1 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting |
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-5874 | Medium | 4.8 | 2023-12-04 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-5809 | Medium | 4.8 | 2023-12-04 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-5343 | Medium | 4.8 | 2023-11-20 | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-34013 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll… |
CVE-2023-4390 | Medium | 4.8 | 2023-10-31 | The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to… |
CVE-2023-39917 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. |
CVE-2023-41871 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions. |
CVE-2023-32498 | Medium | 5.9 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Easy Form team Easy Form by AYS plugin <= 1.2.0 versions. |
CVE-2023-32107 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.1.3 versions. |
CVE-2023-27414 | High | 7.1 | 2023-06-21 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions. |
CVE-2023-2568 | Medium | 6.1 | 2023-06-12 | The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site… |
CVE-2023-2572 | Medium | 6.1 | 2023-06-05 | The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scrip… |
CVE-2023-2571 | Medium | 6.1 | 2023-06-05 | The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scrip… |
CVE-2023-23490 | High | 8.8 | 2023-01-20 | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surv… |
CVE-2023-0038 | High | 7.2 | 2023-01-03 | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and i… |
CVE-2022-1456 | Medium | 4.8 | 2022-05-30 | The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store… |
CVE-2022-1013 | Critical | 9.8 | 2022-05-09 | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement an… |
CVE-2022-0641 | Medium | 6.1 | 2022-03-28 | The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a… |
CVE-2021-26256 | Medium | 4.7 | 2022-02-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). |
CVE-2021-24931 | Critical | 9.8 | 2021-12-06 | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file… |
CVE-2021-24651 | High | 7.5 | 2021-10-11 | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not… |
CVE-2021-34635 | Medium | 6.1 | 2021-08-02 | The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-sett… |
CVE-2021-24484 | High | 7.2 | 2021-08-02 | The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderb… |
CVE-2021-24483 | High | 7.2 | 2021-08-02 | The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderb… |
CVE-2021-24463 | High | 8.8 | 2021-08-02 | The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the order… |
CVE-2021-24462 | High | 8.8 | 2021-08-02 | The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whi… |