# cve.now: AYS PRO

The newest entries naming AYS PRO as an affected vendor (up to 200), of 98 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110379](https://cve.now/CVE-2026-110379.md): WordPress Quiz Maker plugin \<= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-100159](https://cve.now/CVE-2026-100159.md): Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers (CVSS 4.8)
- [CVE-2026-76006](https://cve.now/CVE-2026-76006.md): Photo Gallery by Ays \<= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9)
- [CVE-2026-65565](https://cve.now/CVE-2026-65565.md): WordPress Survey Maker plugin \<= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57361](https://cve.now/CVE-2026-57361.md): WordPress Survey Maker plugin \<= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57631](https://cve.now/CVE-2026-57631.md): WordPress Popup box plugin \<= 6.0.1 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-54192](https://cve.now/CVE-2026-54192.md): WordPress Popup box plugin \<= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-8995](https://cve.now/CVE-2026-8995.md): Poll Maker by AYS \<= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays\_poll\_get\_user\_information' AJAX Action (CVSS 4.3)
- [CVE-2026-6817](https://cve.now/CVE-2026-6817.md): Quiz Maker by AYS \<= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate\_reason' (CVSS 5.8)
- [CVE-2026-32494](https://cve.now/CVE-2026-32494.md): WordPress Image Slider by Ays plugin \<= 2.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25346](https://cve.now/CVE-2026-25346.md): WordPress FAQ Builder AYS plugin \<= 1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-32428](https://cve.now/CVE-2026-32428.md): WordPress Popup Like box plugin \<= 3.7.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32402](https://cve.now/CVE-2026-32402.md): WordPress Image Slider by Ays plugin \<= 2.7.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32342](https://cve.now/CVE-2026-32342.md): WordPress Quiz Maker plugin \<= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-32332](https://cve.now/CVE-2026-32332.md): WordPress Easy Form plugin \<= 2.7.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32329](https://cve.now/CVE-2026-32329.md): WordPress Advanced Related Posts plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-31922](https://cve.now/CVE-2026-31922.md): WordPress Fox LMS plugin \<= 1.0.6.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-1336](https://cve.now/CVE-2026-1336.md): AI ChatBot with ChatGPT and Content Generator by AYS \<= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification (CVSS 5.3)
- [CVE-2026-2367](https://cve.now/CVE-2026-2367.md): Secure Copy Content Protection and Content Locking \<= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute (CVSS 6.4)
- [CVE-2026-26370](https://cve.now/CVE-2026-26370.md): WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. (CVSS 6.1)
- [CVE-2026-2384](https://cve.now/CVE-2026-2384.md): Quiz Maker \<= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2026-25338](https://cve.now/CVE-2026-25338.md): WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin \<= 2.7.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-25335](https://cve.now/CVE-2026-25335.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 5.0.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-1320](https://cve.now/CVE-2026-1320.md): Secure Copy Content Protection and Content Locking \<= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header (CVSS 7.2)
- [CVE-2026-1165](https://cve.now/CVE-2026-1165.md): Popup Box \<= 6.1.1 - Cross-Site Request Forgery to Popup Status Change (CVSS 4.3)
- [CVE-2025-69021](https://cve.now/CVE-2025-69021.md): WordPress Popup box plugin \<= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-66117](https://cve.now/CVE-2025-66117.md): WordPress Easy Form plugin \<= 2.7.8 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-14156](https://cve.now/CVE-2025-14156.md): Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' (CVSS 9.8)
- [CVE-2025-14454](https://cve.now/CVE-2025-14454.md): Image Slider by Ays- Responsive Slider and Carousel \<= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion (CVSS 4.3)
- [CVE-2025-14159](https://cve.now/CVE-2025-14159.md): Secure Copy Content Protection and Content Locking \<= 4.9.2 - Cross-Site Request Forgery to Data Export (CVSS 4.3)
- [CVE-2025-14442](https://cve.now/CVE-2025-14442.md): Secure Copy Content Protection and Content Locking \<= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File (CVSS 5.3)
- [CVE-2025-67595](https://cve.now/CVE-2025-67595.md): WordPress Quiz Maker plugin \<= 6.7.0.82 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-66529](https://cve.now/CVE-2025-66529.md): WordPress Chartify plugin \<= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-13685](https://cve.now/CVE-2025-13685.md): Photo Gallery by Ays \<= 6.4.8 - Cross-Site Request Forgery to Bulk Actions (CVSS 4.3)
- [CVE-2025-13381](https://cve.now/CVE-2025-13381.md): AI ChatBot with ChatGPT and Content Generator by AYS \<= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads (CVSS 5.3)
- [CVE-2025-13378](https://cve.now/CVE-2025-13378.md): AI ChatBot with ChatGPT and Content Generator by AYS \<= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone\_url' Parameter (CVSS 6.5)
- [CVE-2025-12426](https://cve.now/CVE-2025-12426.md): Quiz Maker \<= 6.7.0.80 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-64276](https://cve.now/CVE-2025-64276.md): WordPress Survey Maker plugin \<= 5.1.9.4 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-12620](https://cve.now/CVE-2025-12620.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 6.0.7 - Authenticated (Administrator+) SQL Injection via \`filterbyauthor\` Parameter (CVSS 4.9)
- [CVE-2025-12891](https://cve.now/CVE-2025-12891.md): Survey Maker \<= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3)
- [CVE-2025-12892](https://cve.now/CVE-2025-12892.md): Survey Maker \<= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update (CVSS 5.3)
- [CVE-2025-62039](https://cve.now/CVE-2025-62039.md): WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin \<= 2.6.6 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2025-57931](https://cve.now/CVE-2025-57931.md): WordPress Popup box plugin \<= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.3)
- [CVE-2025-48098](https://cve.now/CVE-2025-48098.md): WordPress Survey Maker plugin \<= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-48095](https://cve.now/CVE-2025-48095.md): WordPress Survey Maker plugin \<= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-11171](https://cve.now/CVE-2025-11171.md): Chartify – WordPress Chart Plugin \<= 3.5.9 - Missing Authentication for Administrative Function (CVSS 5.3)
- [CVE-2025-57947](https://cve.now/CVE-2025-57947.md): WordPress Photo Gallery by Ays Plugin \<= 6.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-57954](https://cve.now/CVE-2025-57954.md): WordPress Poll Maker Plugin \<= 6.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-58014](https://cve.now/CVE-2025-58014.md): WordPress Quiz Maker Plugin \<= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-58015](https://cve.now/CVE-2025-58015.md): WordPress Quiz Maker Plugin \<= 6.7.0.65 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
- [CVE-2025-10042](https://cve.now/CVE-2025-10042.md): Quiz Maker \<= 6.7.0.56 - Unauthenticated SQL Injection (CVSS 5.9)
- [CVE-2024-12575](https://cve.now/CVE-2024-12575.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 5.8.9 - Unauthenticated Basic Information Exposure (CVSS 5.3)
- [CVE-2025-54673](https://cve.now/CVE-2025-54673.md): WordPress Chartify plugin \<= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-47545](https://cve.now/CVE-2025-47545.md): WordPress Poll Maker plugin \<= 5.7.7 - Race Condition Vulnerability (CVSS 5.3)
- [CVE-2025-24577](https://cve.now/CVE-2025-24577.md): WordPress Poll Maker plugin \<= 5.5.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-27285](https://cve.now/CVE-2025-27285.md): WordPress Easy Form by AYS Plugin \<= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32275](https://cve.now/CVE-2025-32275.md): WordPress Survey Maker plugin \<= 5.1.6.3 - Bypass vulnerability (CVSS 4.3)
- [CVE-2025-32133](https://cve.now/CVE-2025-32133.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-30905](https://cve.now/CVE-2025-30905.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-30774](https://cve.now/CVE-2025-30774.md): WordPress Quiz Maker plugin \<= 6.6.8.7 - SQL Injection vulnerability (CVSS 8.2)
- [CVE-2025-30904](https://cve.now/CVE-2025-30904.md): WordPress Chartify plugin \<= 3.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-1404](https://cve.now/CVE-2025-1404.md): Secure Copy Content Protection and Content Locking \<= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays\_sccp\_reports\_user\_search Function (CVSS 5.3)
- [CVE-2025-26971](https://cve.now/CVE-2025-26971.md): WordPress Poll Maker \<= 5.6.5 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-22664](https://cve.now/CVE-2025-22664.md): WordPress Survey Maker Plugin \<= 5.1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-13505](https://cve.now/CVE-2024-13505.md): Survey Maker \<= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question (CVSS 5.5)
- [CVE-2025-24722](https://cve.now/CVE-2025-24722.md): WordPress FAQ Builder AYS Plugin \<= 1.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-56277](https://cve.now/CVE-2024-56277.md): WordPress Poll Maker Plugin \< 5.5.5 - HTML Injection vulnerability (CVSS 5.3)
- [CVE-2024-56295](https://cve.now/CVE-2024-56295.md): WordPress Poll Maker plugin \<= 5.5.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2023-45766](https://cve.now/CVE-2023-45766.md): WordPress Poll Maker plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-50904](https://cve.now/CVE-2023-50904.md): WordPress Poll Maker plugin \<= 4.8.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-12115](https://cve.now/CVE-2024-12115.md): Poll Maker \<= 5.5.4 - Cross-Site Request Forgery to Poll Duplication (CVSS 4.3)
- [CVE-2024-11458](https://cve.now/CVE-2024-11458.md): FAQ Builder AYS \<= 1.7.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10861](https://cve.now/CVE-2024-10861.md): Popup Box – Create Countdown, Coupon, Video, Contact Form Popups \<= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update (CVSS 5.3)
- [CVE-2024-10571](https://cve.now/CVE-2024-10571.md): Chartify – WordPress Chart Plugin \<= 2.9.5 - Unauthenticated Local File Inclusion via source (CVSS 9.8)
- [CVE-2024-9874](https://cve.now/CVE-2024-9874.md): WordPress Poll Maker Plugin \<= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection (CVSS 4.9)
- [CVE-2024-50426](https://cve.now/CVE-2024-50426.md): WordPress Survey Maker plugin \<= 5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-9462](https://cve.now/CVE-2024-9462.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings (CVSS 5.5)
- [CVE-2024-9475](https://cve.now/CVE-2024-9475.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order\_by Parameter (CVSS 4.9)
- [CVE-2024-8488](https://cve.now/CVE-2024-8488.md): Survey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms \<= 4.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-47306](https://cve.now/CVE-2024-47306.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-47347](https://cve.now/CVE-2024-47347.md): WordPress Chartify plugin \<= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-6028](https://cve.now/CVE-2024-6028.md): Quiz Maker \<= 6.5.8.3 - Unauthenticated SQL Injection via 'ays\_questions' Parameter (CVSS 9.8)
- [CVE-2024-3601](https://cve.now/CVE-2024-3601.md): Poll Maker – Best WordPress Poll Plugin \<= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration (CVSS 5.3)
- [CVE-2024-3897](https://cve.now/CVE-2024-3897.md): Popup Box – Best WordPress Popup Plugin \<= 4.3.6 - Missing Authorization to Information Exposure (CVSS 5.3)
- [CVE-2024-3600](https://cve.now/CVE-2024-3600.md): Poll Maker – Best WordPress Poll Plugin \<= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-1078](https://cve.now/CVE-2024-1078.md): Quiz Maker \<= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification (CVSS 4.3)
- [CVE-2024-1079](https://cve.now/CVE-2024-1079.md): Quiz Maker \<= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval (CVSS 5.3)
- [CVE-2023-0038](https://cve.now/CVE-2023-0038.md): Survey Maker – Best WordPress Survey Plugin \<= 3.1.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2021-24484](https://cve.now/CVE-2021-24484.md): Secure Copy Content Protection and Content Locking \< 2.6.7 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24483](https://cve.now/CVE-2021-24483.md): Poll Maker \< 3.2.1 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24463](https://cve.now/CVE-2021-24463.md): Image Slider by Ays - Responsive Slider and Carousel \< 2.5.0 - Authenticated Blind SQL Injection (no CVSS)
- [CVE-2021-24462](https://cve.now/CVE-2021-24462.md): Photo Gallery by Ays - Responsive Image Gallery \< 4.4.4 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24461](https://cve.now/CVE-2021-24461.md): FAQ Builder \< 1.3.6 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24460](https://cve.now/CVE-2021-24460.md): Popup Like box - Page Plugin \< 3.5.3 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24459](https://cve.now/CVE-2021-24459.md): Survey Maker \< 1.5.6 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24458](https://cve.now/CVE-2021-24458.md): Popup box \< 2.3.4 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24457](https://cve.now/CVE-2021-24457.md): Portfolio Responsive Gallery \< 1.1.8 - Authenticated Blind SQL Injections (no CVSS)
- [CVE-2021-24456](https://cve.now/CVE-2021-24456.md): Quiz Maker \< 6.2.0.9 - Multiple Authenticated Blind SQL Injections (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ays-pro
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.