# AYS Pro vulnerabilities Source: https://junglewise.ai/threats/vendors/ays-pro Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/ays-pro.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in AYS Pro: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110379, was published on 19 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 9 (0 critical, 0 exploited in the wild) ## About AYS Pro A software developer specializing in WordPress plugins for surveys, quizzes, and polls. ## Latest AYS Pro vulnerabilities - [CVE-2026-110379: Ays Pro Quiz Maker reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-110379-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 19 Oct 2026) - [CVE-2026-57361: Ays Pro Survey Maker unauthenticated XSS](https://junglewise.ai/threats/cve-2026-57361-ays-pro-survey-maker-unauthenticated-xss) (high, CVSS 7.1, published 2 Jul 2026) - [CVE-2026-57631: Ays Pro Popup box SQL injection in administrator interface](https://junglewise.ai/threats/cve-2026-57631-ays-pro-popup-box-sql-injection-in-administrator-interface) (high, CVSS 7.6, published 26 Jun 2026) - [CVE-2026-54192: Ays Pro Popup box unauthenticated XSS](https://junglewise.ai/threats/cve-2026-54192-ays-pro-popup-box-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-9269: Secure Copy Content Protection and Content Locking Stored XSS in settings](https://junglewise.ai/threats/cve-2026-9269-secure-copy-content-protection-and-content-locking-stored-xss-in) (info, CVSS 3.5, published 12 Jun 2026) - [CVE-2026-8995: ays-pro Poll Maker sensitive information exposure in AJAX action](https://junglewise.ai/threats/cve-2026-8995-ays-pro-poll-maker-sensitive-information-exposure-in-ajax-action) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2025-15611: The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function…](https://junglewise.ai/threats/cve-2025-15611-the-popup-box-wordpress-plugin-before-5-5-0-does-not-properly) (medium, CVSS 5.4, published 7 Apr 2026) - [CVE-2025-67595: Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request…](https://junglewise.ai/threats/cve-2025-67595-cross-site-request-forgery-csrf-vulnerability-in-ays-pro-quiz) (medium, CVSS 4.3, published 9 Dec 2025) - [CVE-2025-12426: The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…](https://junglewise.ai/threats/cve-2025-12426-the-quiz-maker-plugin-for-wordpress-is-vulnerable-to-sensitive) (medium, CVSS 5.3, published 19 Nov 2025) ## Most severe AYS Pro vulnerabilities - [CVE-2026-57631: Ays Pro Popup box SQL injection in administrator interface](https://junglewise.ai/threats/cve-2026-57631-ays-pro-popup-box-sql-injection-in-administrator-interface) (high, CVSS 7.6, published 26 Jun 2026) - [CVE-2026-54192: Ays Pro Popup box unauthenticated XSS](https://junglewise.ai/threats/cve-2026-54192-ays-pro-popup-box-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-110379: Ays Pro Quiz Maker reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-110379-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 19 Oct 2026) - [CVE-2026-57361: Ays Pro Survey Maker unauthenticated XSS](https://junglewise.ai/threats/cve-2026-57361-ays-pro-survey-maker-unauthenticated-xss) (high, CVSS 7.1, published 2 Jul 2026) - [CVE-2025-15611: The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function…](https://junglewise.ai/threats/cve-2025-15611-the-popup-box-wordpress-plugin-before-5-5-0-does-not-properly) (medium, CVSS 5.4, published 7 Apr 2026) - [CVE-2025-12426: The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…](https://junglewise.ai/threats/cve-2025-12426-the-quiz-maker-plugin-for-wordpress-is-vulnerable-to-sensitive) (medium, CVSS 5.3, published 19 Nov 2025) - [CVE-2025-67595: Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request…](https://junglewise.ai/threats/cve-2025-67595-cross-site-request-forgery-csrf-vulnerability-in-ays-pro-quiz) (medium, CVSS 4.3, published 9 Dec 2025) - [CVE-2026-8995: ays-pro Poll Maker sensitive information exposure in AJAX action](https://junglewise.ai/threats/cve-2026-8995-ays-pro-poll-maker-sensitive-information-exposure-in-ajax-action) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2026-9269: Secure Copy Content Protection and Content Locking Stored XSS in settings](https://junglewise.ai/threats/cve-2026-9269-secure-copy-content-protection-and-content-locking-stored-xss-in) (info, CVSS 3.5, published 12 Jun 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## AYS Pro technologies - [AYS Pro Popup box](https://junglewise.ai/threats/technologies/popup-box): 3 vulnerabilities - [AYS Pro Quiz Maker](https://junglewise.ai/threats/technologies/quiz-maker): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "AYS Pro vulnerabilities", https://junglewise.ai/threats/vendors/ays-pro, 9 November 2026.