Security Alert Summary
The SurveyJS plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in survey result submissions. Insufficient input sanitization and output escaping allow unauthenticated attackers to submit HTML-encoded payloads that are decoded and rendered when an administrator views survey results, resulting in stored XSS in the administrative context.
CVE Details
- CVE ID: CVE-2026-2440
- Affected plugin / component: SurveyJS plugin for WordPress
- Affected versions: All versions up to and including 2.5.3
- Published: March 21, 2026 at 4:17:02 AM
- Last modified: March 21, 2026 at 4:17:02 AM
- CVSS v3.1: Base Score 7.2, Severity: HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The plugin fails to sufficiently sanitize and escape survey result input and output. The public survey page exposes the nonce required for submission, allowing unauthenticated attackers to submit HTML-encoded payloads as survey results. Those payloads are decoded and rendered as executable HTML when an administrator views the stored survey results, causing stored XSS in the admin context.
Repository paths referenced in the disclosure show handling of survey submissions and result rendering (for example, ajax_handlers/save_result.php and views/results.php), indicating that the issue occurs during result submission and when results are output to administrators. The root cause is insufficient input sanitization on submission and missing or incorrect output escaping when rendering stored results.
Impact is limited to what can be achieved via script execution in an administrator’s browser when viewing results (for example, actions available to that administrator session). The vulnerability does not indicate direct elevation of WordPress privileges or server-side code execution by itself.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff managing content, and external contributors or contractors who publish public surveys. An attacker could submit a malicious survey response without authentication. When an administrator or staff member opens the survey results page, the stored script could execute in their browser context.
- Scripts running in an administrator’s browser can read data visible in that context, potentially exposing internal information or user-visible fields (for example, names or email addresses shown on result pages).
- Exposed emails or visible data can increase the risk of targeted phishing or social engineering against staff or contractors.
- Scripts could attempt actions available to the administrator in their browser session (for example, making requests using the administrator’s authenticated session), limited by the administrator’s privileges and site protections.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts that can access survey result pages.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and administrative pages for unusual behavior, and review recent survey submissions for unexpected content.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
