CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2021-24765

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24765

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24764

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters id and filterssessionid of singlestatistics page, type and message of importexport page before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripti...

CVE-2021-24765

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

Cross site scripting

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

Sql injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2021-24765

The CVE-2021-24765 issue affects the WordPress Perfect Survey plugin up to version 1.5.2. The root cause is failure to validate/escape the X-Forwarded-For header when Anonymize IP is off, allowing Stored Cross-Site Scripting on the statistic page. Affected component: the plugin’s statistic page r...

CVE-2021-24764

The CVE-2021-24764 issue affects the Perfect Survey WordPress plugin prior to version 1.5.2. The vulnerability stems from insufficient sanitisation/escaping of user-supplied input in admin pages: id and filters[session_id] on the single_statistics page, and type and message on the importexport pa...

CVE-2021-24763

CVE-2021-24763 affects the WordPress Perfect Survey plugin prior to 1.5.2. The issue is an unauthorised AJAX path (save_global_setting) lacking proper authorisation/CSRF checks, allowing unauthenticated users to edit surveys and settings. Due to insufficient sanitisation/escaping, this can enable...

CVE-2021-24762

CVE-2021-24762 affects WordPress Perfect Survey plugin versions before 1.5.2. The get_question AJAX action does not validate/escape the question_id parameter, enabling unauthenticated SQL injection. Consequences can include unauthorized access to data and potential compromise of the database. Rem...

CVE-2021-24762 Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

PT-2022-9461

Name of the Vulnerable Software and Affected Versions The Perfect Survey WordPress plugin versions 1.5.2 and earlier Description The issue arises from the lack of validation and escaping of the X-Forwarded-For header value before it is outputted in the statistic page. This occurs when the Anonymi...

WordPress plugin cross-site request forgeing vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Perfect Survey plugin in versions prior to 1.5.2 has a cross-site request forgery vulnerability, which stems from the absence of CSRF in the saveglobalsetting AJAX action check, an...

CVE-2021-24763: Cross-Site Request Forgery (CSRF)

The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the saveglobalsetting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stor...

WordPress plugin: SQL injection vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language.The WordPress Perfect Survey plugin has a SQL injection vulnerability in versions prior to 1.5.2, which stems from the lack of validation of externally entered SQL statements in database-based...

WordPress plugin cross-site scripting vulnerability

WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress plugin Perfect Survey versions prior to 1.5.2, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

PT-2022-9460

Name of the Vulnerable Software and Affected Versions The Perfect Survey WordPress plugin versions prior to 1.5.2 Description The issue is related to Reflected Cross-Site Scripting. It occurs because the plugin does not properly sanitise and escape certain parameters, specifically id and...

CVE-2021-24764: Improper Neutralization of Input During Web Page Generation

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters id and filterssessionid of singlestatistics page, type and message of importexport page before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripti...

PT-2022-9459

Name of the Vulnerable Software and Affected Versions The Perfect Survey WordPress plugin versions prior to 1.5.2 Description The issue is related to the lack of proper authorization and CSRF checks in the save global setting AJAX action. This allows unauthenticated users to edit surveys and modi...