Surveyjs Vulnerabilities

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions. This is due to insufficient input sanitization and output escaping. The public survey page exposes the nonce required for submission, allowing unauthenticated attacke...

CVSS:

7.2

Affected:

up to 2.5.3

Fix:

No patched version reported

Disclosed:

Mar 20, 2026

CVE-2026-2440 on NVD →

[en] The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action...

Affected:

up to 1.12.20

Fix:

No patched version reported

Disclosed:

Jan 24, 2026

CVE-2025-13205 on NVD →

[en] The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce verification on the 'SurveyJS_RenameSurvey' AJAX action. This mak...

Affected:

up to 1.12.20

Fix:

No patched version reported

Disclosed:

Jan 24, 2026

CVE-2025-13194 on NVD →

[en] The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_AddSurvey AJAX action. This makes it possible for unauthenticated attackers to create surveys via...

Affected:

up to 1.12.20

Fix:

No patched version reported

Disclosed:

Jan 24, 2026

CVE-2025-13139 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This...

CVSS:

4.3

Affected:

up to 2.5.2

Fixed in:

2.5.3

Disclosed:

Jan 23, 2026

CVE-2025-13205 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce verification on the 'SurveyJS_RenameSurvey' AJAX action. This makes it p...

CVSS:

4.3

Affected:

up to 2.5.2

Fixed in:

2.5.3

Disclosed:

Jan 23, 2026

CVE-2025-13194 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce validation on the SurveyJS_AddSurvey AJAX action. This makes it possible for unauthenticated attackers to create surveys via a forge...

CVSS:

4.3

Affected:

up to 2.5.2

Fixed in:

2.5.3

Disclosed:

Jan 23, 2026

CVE-2025-13139 on NVD →

[en] The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_DeleteSurvey AJAX action. This makes it possible for unauthenticated attackers to delete surveys v...

Affected:

up to 1.20.27

Fixed in:

1.20.27

Disclosed:

Dec 2, 2025

CVE-2025-13140 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_DeleteSurvey AJAX action. This makes it possible for unauthenticated attackers to delete surveys via a...

CVSS:

4.3

Affected:

up to 1.12.20

Fixed in:

1.20.27

Disclosed:

Dec 1, 2025

CVE-2025-13140 on NVD →

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary...

CVSS:

6.4

Affected:

up to 1.12.32

Fixed in:

1.12.33

Disclosed:

May 2, 2025

CVE-2025-3815 on NVD →

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.12.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.12.20

Fixed in:

1.12.57

Disclosed:

Apr 4, 2025

CVE-2025-32167 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.12.20. This makes it possible for unauthenticated attackers to pe...

CVSS:

5.3

Affected:

up to 1.12.20

Fixed in:

1.12.57

Disclosed:

Apr 4, 2025

CVE-2025-32256 on NVD →

[en] Missing Authorization vulnerability in devsoftbaltic SurveyJS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects SurveyJS: from n/a through 1.12.20.

Affected:

up to 1.12.20

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32256 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devsoftbaltic SurveyJS allows Stored XSS. This issue affects SurveyJS: from n/a through 1.12.20.

Affected:

up to 1.12.20

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32167 on NVD →

[en] The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This...

Affected:

up to 1.12.18

Fixed in:

1.12.18

Disclosed:

Mar 1, 2025

CVE-2024-12544 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes...

CVSS:

8.8

Affected:

up to 1.12.17

Fixed in:

1.12.18

Disclosed:

Feb 28, 2025

CVE-2024-12544 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÜ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.

Affected:

up to 1.12.4

Fixed in:

1.12.4

Disclosed:

Oct 29, 2024

CVE-2024-50427 on NVD →

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.9.136. This makes it possible for authenticated attackers, with Subscriber...

CVSS:

8.8

Affected:

up to 1.9.136

Fixed in:

1.12.4

Disclosed:

Oct 24, 2024

CVE-2024-50427 on NVD →

Affected:

up to 1.12.33

Fixed in:

1.12.33

CVE-2025-3815 on NVD →