Security Alert Summary
The Survey plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in administrative settings that can allow authenticated attackers with administrator-level permissions to inject JavaScript into pages. This injection can execute when a user accesses an injected page. The issue affects multi-site installations and installations where unfiltered_html has been disabled.
CVE Details
- CVE ID:
CVE-2026-1247 - Affected component: The Survey plugin for WordPress
- Affected versions: All versions up to, and including, 1.1
- Published: March 21, 2026 at 4:16:51 AM UTC
- Last modified: March 21, 2026 at 4:16:51 AM UTC
- CVSS v3.1: Base score 4.4, MEDIUM —
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires high privileges (authenticated administrator-level permissions); no user interaction required
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue resulting from insufficient input sanitization and output escaping in the plugin’s administrative settings. An attacker with administrator-level permissions can store arbitrary web script in settings that are later rendered in pages; those scripts execute when a user views the affected page.
References indicate the relevant code paths include files such as inc/form.php and inc/shortcode.php (see references). The core problem is missing or inadequate sanitization and escaping on settings input and output, which permits stored script content to persist in the site data and be served to other users.
The vulnerability only applies in specific deployment contexts: multi-site WordPress installations and standard installations where the unfiltered_html capability has been disabled, limiting exposure to those configurations. The impact is limited to data exposure and script execution within the site pages where the injected content appears; it does not, based on the provided information, indicate direct remote code execution on the server or complete site takeover.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff (editors), and an external contractor who helps manage content. If an attacker with administrator-level access adds a malicious script to a plugin setting, that script could run when internal staff or external contributors view pages that render the injected setting. Practical consequences include exposure of internal user context, potential capture of session-related data shown in the page, and increased opportunity for targeted phishing or social engineering based on visible user information.
For example, an attacker could inject UI-modifying scripts that display fake prompts or capture data entered by other users. Even with low confidentiality and integrity impact ratings, such access can aid attackers in gathering emails or other information used to craft convincing phishing messages targeted at staff or contractors.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and non-essential administrator accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, particularly actions performed by administrator accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/survey/tags/1.1/inc/form.php#L73
- https://plugins.trac.wordpress.org/browser/survey/tags/1.1/inc/shortcode.php#L35
- https://plugins.trac.wordpress.org/browser/survey/trunk/inc/form.php#L73
- https://plugins.trac.wordpress.org/browser/survey/trunk/inc/shortcode.php#L35
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9b6efa-b82e-4fe5-bf56-4ca49e9ebe71?source=cve
