CVE-2021-24459: The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the ge

high Affects survey-maker (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2021-08-02; advisory modified 2026-06-17.

The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the ge

Package: survey-maker (WordPress plugin) WordPress
Affected versions: <1.5.6
Fixed in: 1.5.6
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2021-08-02
Source: nvd

References

CWE-89

NVD record survey-maker (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2023-23490 high The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL in same package: survey-maker (WordPress plugin)
CVE-2021-26256 medium Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker same package: survey-maker (WordPress plugin)
CVE-2023-0038 high The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to St same package: survey-maker (WordPress plugin)
CVE-2023-2572 medium The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outp same package: survey-maker (WordPress plugin)
CVE-2024-4061 medium The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its s same package: survey-maker (WordPress plugin)
CVE-2024-8488 medium The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Sur same package: survey-maker (WordPress plugin)