Ays-pro vulnerabilities
We track 28 vulnerabilities in Ays-pro products across 15 products. 28 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest Ays-pro vulnerabilities
- 7.1 High severity
Quiz Maker: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
- 7.1 High severity
Image Slider by Ays: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/
- 7.1 High severity
FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a t
- 8.5 High severity
Fox LMS: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through <= 1.0.6.3.
- 7.2 High severity
Secure Copy Content Protection and Content…: Improper Neutralization of Input During Web Page Generation
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escapin
- 7.5 High severity
Easy Form: Missing Authorization
Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.8.
- 9.8 Critical severity
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation…
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/pay
- 7.5 High severity
Quiz Maker: Exposure of Sensitive Information to an Unauthorized Actor
The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization check
- 7.5 High severity
AI ChatBot with ChatGPT and Content Generator…: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AY
- 7.1 High severity
Survey Maker: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
- 7.5 High severity
Quiz Maker: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.
- 7.5 High severity
Quiz Maker: Improper Neutralization of Special Elements used in an SQL Command
The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. T
- 8.1 High severity
Poll Maker: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Ays Pro Poll Maker poll-maker allows Leveraging Race Conditions.This issue affects Poll Maker: from n/a through <= 5.7.7.
- 7.1 High severity
Easy Form: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Easy Form easy-form allows Reflected XSS.This issue affects Easy Form: from n/a through <= 2.6.9.
- 9.8 Critical severity
Poll Maker: Missing Authorization
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 5.5.0.
- 7.1 High severity
Secure Copy Content Protection and Content…: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection
- 9.8 Critical severity
Quiz Maker: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker quiz-maker allows SQL Injection.This issue affects Quiz Maker: from n/a through <= 6.6.8.7.
- 9.8 Critical severity
Poll Maker: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection.This issue affects Poll Maker: from n/a through <= 5.6.5.
- 7.5 High severity
Quiz Maker Business: Improper Neutralization of Special Elements used in an SQL Command
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agenc
- 9.8 Critical severity
Chartify – WordPress Chart Plugin: Improper Control of Filename for Include/Require Statement in PHP Program
The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files
- 7.2 High severity
Poll Maker – Versus Polls, Anonymous Polls…: Improper Neutralization of Special Elements used in an SQL Command
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and l
- 7.2 High severity
Poll Maker – Versus Polls, Anonymous Polls…: Improper Neutralization of Special Elements used in an SQL Command
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack
- 7.1 High severity
Secure Copy Content Protection and Content…: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection-subscribe-to-view allows Stored XSS.This issue affects Secure Copy C
- 7.1 High severity
Chartify: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Reflected XSS.This issue affects Chartify: from n/a through <= 2.7.6.
- 7.5 High severity
AI ChatBot with ChatGPT and Content Generator…: Cleartext Transmission of Sensitive Information
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
- 9.8 Critical severity
Quiz Maker: Improper Neutralization of Special Elements used in an SQL Command
The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the
- 7.5 High severity
Poll Maker – Best WordPress Poll Plugin: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll Plugin: from n/a through 4.6.2.
- 8.8 High severity
Survey Maker WordPress Plugin: Improper Neutralization of Special Elements used in an SQL Command
The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.