CVE-2025-10196: Survey Anyplace WordPress Plugin XSS Flaw

CVE-2025-10196 Overview

CVE-2025-10196 is a Stored Cross-Site Scripting (XSS) vulnerability in the Survey Anyplace plugin for WordPress. The flaw affects all versions up to and including 1.0.0. The root cause is insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's surveyanyplace_embed shortcode. Authenticated attackers holding contributor-level access or above can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. The vulnerability is categorized under [CWE-79].

Critical Impact
Contributor-level users can persist arbitrary JavaScript inside WordPress content, enabling session theft, forced administrative actions, and delivery of secondary payloads to site visitors.

Affected Products

Survey Anyplace plugin for WordPress
All versions up to and including 1.0.0
WordPress sites permitting contributor-or-higher registration

Discovery Timeline

2025-09-30 - CVE-2025-10196 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10196

Vulnerability Analysis

The Survey Anyplace plugin registers a WordPress shortcode named surveyanyplace_embed intended to embed survey content within posts and pages. The shortcode handler accepts attributes supplied by the content author and renders them into the page markup. The handler fails to sanitize inbound attribute values and fails to escape those values on output. As a result, attribute strings containing HTML or JavaScript are rendered verbatim within the response.

WordPress by design allows contributor-level users to draft content that includes shortcodes. When an editor or administrator previews or publishes the draft, the malicious shortcode payload renders in an authenticated administrative context. This crosses a trust boundary, which is reflected in the scope-changed impact of the flaw. The Wordfence advisory documents the vulnerable rendering path in surveyanyplace-shortcodes.php and the associated template file surveyanyplace.php.

Root Cause

The plugin's shortcode callback interpolates attribute values directly into HTML output without calling WordPress sanitization helpers such as sanitize_text_field() on input or escape helpers such as esc_attr() and esc_html() on output. The missing input filtering and missing contextual output escaping together permit stored script injection [CWE-79].

Attack Vector

An attacker with contributor privileges authors a post that contains the surveyanyplace_embed shortcode with a crafted attribute value carrying JavaScript. The post is saved to the WordPress database, which is what makes the XSS stored rather than reflected. When any user visits the rendered page, or when an administrator previews the pending submission, the injected script executes with the visitor's browser privileges against the site origin. Practical outcomes include cookie exfiltration, forced privileged actions via the WordPress REST API, and pivoting to full administrator takeover.

No verified public proof-of-concept has been published. Technical details are available in the Wordfence Vulnerability Analysis, the WordPress Shortcodes Resource, and the WordPress Survey Template.

Detection Methods for CVE-2025-10196

Indicators of Compromise

Posts or pages in wp_posts containing the string surveyanyplace_embed combined with <script, onerror=, onload=, or javascript: inside shortcode attributes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains referenced by injected script tags.
New administrator accounts or altered user roles created shortly after a contributor account submitted content.

Detection Strategies

Query the WordPress database for shortcode occurrences: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%surveyanyplace_embed%'; and inspect matched attributes for HTML or script characters.
Enable content security policy (CSP) reporting on the WordPress site and review report-uri submissions for inline script violations.
Review web server access logs for POST requests to wp-admin/post.php and wp-admin/admin-ajax.php from contributor accounts followed by administrator sessions loading the affected pages.

Monitoring Recommendations

Alert on creation or modification of posts by contributor-role users that reference plugin shortcodes.
Monitor for new WordPress user accounts created via authenticated REST API calls originating from unusual IP addresses.
Track browser-side JavaScript errors and CSP violations on published pages to surface injected payloads early.

How to Mitigate CVE-2025-10196

Immediate Actions Required

Deactivate and remove the Survey Anyplace plugin on any WordPress site running version 1.0.0 or earlier until a patched release is confirmed.
Audit all posts and pages for the surveyanyplace_embed shortcode and remove attributes containing HTML, script tags, or JavaScript URI schemes.
Rotate WordPress administrator credentials and invalidate active sessions if injected payloads are found.
Review the contributor user list and remove accounts that are unused, unverified, or unrecognized.

Patch Information

As of the last NVD update on 2026-06-17, no fixed version has been published in the enriched data. Track the Wordfence Vulnerability Analysis for the vendor-supplied fixed release. Apply the patched version immediately once available and revalidate content stored during the exposure window.

Workarounds

Restrict the contributor role or disable open user registration until the plugin is patched or removed.
Deploy a web application firewall rule that blocks requests containing surveyanyplace_embed combined with script-injection patterns in post_content.
Enforce a strict Content Security Policy that disallows inline scripts and unapproved third-party script sources to limit stored XSS execution.
Use the WordPress capability filter to revoke unfiltered_html from all non-administrator roles and confirm contributors cannot bypass shortcode sanitization.