The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filterssession_id of single_statistics page type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard leading to Reflected Cross-Site Scripting issues