Pantherius vulnerabilities

Products

• Modal Survey 4
• WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress 2
• Simple Signup Form 1

Latest Pantherius CVEs

Newest publication first

1. CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-08-18

   Medium·CVSS 4.3 EPSS 0.27%

   Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

2. CVE-2025-39468 WordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerability

   Published 2025-11-06

   High·CVSS 8.1 EPSS 0.68%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

3. CVE-2025-39469 WordPress Modal Survey plugin <= 2.0.2.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-18

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

4. CVE-2025-39471 WordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability

   Published 2025-04-18

   Critical·CVSS 9.3 EPSS 0.38%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

5. CVE-2024-13595 Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection

   Published 2025-02-18

   Medium·CVSS 6.5 EPSS 0.39%

   The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

6. CVE-2024-13596 WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injection

   Published 2025-01-30

   Medium·CVSS 6.5 EPSS 0.35%

   The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter an...

7. CVE-2024-12528 WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-01-07

   Medium·CVSS 6.4 EPSS 0.35%

   The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypoll_results' shortcode in all versions up to, and including, 1.7.5 due to insufficient input sanitization and outp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.