AYS PRO vulnerabilities
98 CVEs and advisories name AYS PRO as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110379WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-100159Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
- CVE-2026-76006Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- CVE-2026-65565WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57361WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57631WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
- CVE-2026-54192WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-8995Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action
- CVE-2026-6817Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
- CVE-2026-32494WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25346WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32428WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability
- CVE-2026-32402WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability
- CVE-2026-32342WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32332WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability
- CVE-2026-32329WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability
- CVE-2026-31922WordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerability
- CVE-2026-1336AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification
- CVE-2026-2367Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
- CVE-2026-26370WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability.
- CVE-2026-2384Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-25338WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability
- CVE-2026-25335WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability
- CVE-2026-1320Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
- CVE-2026-1165Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
- CVE-2025-69021WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-66117WordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerability
- CVE-2025-14156Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
- CVE-2025-14454Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion
- CVE-2025-14159Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export