Approved changes feed: RSS · Atom
cpe:2.3:a:devsoftbaltic:surveyjs:_drag_&_drop_form_builder:*:*:*:*:*:*:*:*
part: a version: _drag_&_drop_form_builder update: *
| Vendor | Devsoftbaltic (208504f2-93f8-5544-b04e-55727d904b66) |
|---|---|
| Product | Surveyjs (4cf22b93-f89d-5ee3-bb8a-9f73a259e593) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-2440 |
vulnerable | 2026-06-08 07:55:17.052852 |
SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
HIGH (7.2)
The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions. This is due to insufficient input sanitization and output escaping. The public survey page exposes the nonce required for submission, allowing unauthenticated attackers to submit HTML-encoded payloads that are decoded and rendered as executable HTML when an administrator views survey results, leading to stored XSS in the admin context.
Published: 2026-03-21T03:26:31.223Z
Updated: 2026-04-08T16:34:09.980Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3815 |
vulnerable | 2026-06-08 07:23:09.940394 |
SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
MEDIUM (6.4)
The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-05-03T07:22:57.130Z
Updated: 2026-04-08T17:20:32.894Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13205 |
vulnerable | 2026-06-08 07:04:31.781257 |
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
MEDIUM (4.3)
The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This makes it possible for unauthenticated attackers to duplicate surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-01-24T09:08:09.131Z
Updated: 2026-04-08T17:28:53.596Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13194 |
vulnerable | 2026-06-08 07:04:31.770838 |
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
MEDIUM (4.3)
The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce verification on the 'SurveyJS_RenameSurvey' AJAX action. This makes it possible for unauthenticated attackers to rename surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-01-24T09:08:08.275Z
Updated: 2026-04-08T17:14:39.599Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13140 |
vulnerable | 2026-06-08 07:04:31.683854 |
SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion
MEDIUM (4.3)
The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS_DeleteSurvey AJAX action. This makes it possible for unauthenticated attackers to delete surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-12-02T06:40:25.286Z
Updated: 2026-04-08T16:55:56.111Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13139 |
vulnerable | 2026-06-08 07:04:31.683539 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12544 |
vulnerable | 2026-06-08 06:25:35.512417 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.