CVE-2026-72690

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

EUVD-2026-55528

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-72690

CVE-2026-72690 | Attendize : An improper authorization vulnerability allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer’s events via POST /event/{event_id}/question/create. The root cause is that postCreateEventQuestion loads the target ...

CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-65565

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

CVE-2026-66425

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

EUVD-2026-53880

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425

Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.

CVE-2026-65565

CVE-2026-65565 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Survey Maker plugin up to version 5.2.3.3. The initial data provides CVSSv3.1 base score 7.1 (HIGH) with NETWORK attack vector, LOW impact on confidentiality/integrity/availability, and user inte...

EUVD-2026-53986

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

CVE-2026-65565

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

CVE-2026-65565 WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Survey Maker versions = 5.2.3.3...

PT-2026-68557

Name of the Vulnerable Software and Affected Versions Survey Maker versions prior to 5.2.3.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute...

CVE-2026-65565: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

WordPress Survey Maker by AYS plugin < 5.1.7.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Shogo Kumamaru in WordPress Plugin Survey Maker versions 5.1.7.7...

Server-side Request Forgery

LimeSurvey is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the HTTP Host header in getTemplateData, allowing authenticated attackers to force the server to send requests to internal services or cloud metadata endpoints and potentially expose...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...