CVE-2025-28878 Overview
CVE-2025-28878 is a stored cross-site scripting (XSS) vulnerability in the Awesome Surveys WordPress plugin developed by Will Brubaker. The flaw affects all versions of the plugin up to and including 2.0.10. An authenticated attacker with high privileges can inject malicious script content that persists in the application and executes in the browsers of users who view affected pages. The issue is tracked under CWE-79 for improper neutralization of input during web page generation. Patchstack published the coordinated disclosure through its vulnerability database.
Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in the context of the victim's session, enabling session theft, redirection, or defacement across a scope change boundary.
Affected Products
- Will Brubaker Awesome Surveys plugin for WordPress
- All versions from initial release through 2.0.10
- WordPress sites with the vulnerable plugin activated
Discovery Timeline
- 2025-03-11 - CVE-2025-28878 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28878
Vulnerability Analysis
The Awesome Surveys plugin fails to properly sanitize and encode user-supplied input before rendering it within generated web pages. This allows an authenticated attacker to submit crafted payloads containing JavaScript that the plugin later stores and returns unescaped. When another user loads the affected page, the browser interprets the payload as executable script. The stored nature of the flaw means each visit re-triggers the injected code, expanding the blast radius beyond a single request. The vulnerability crosses a security scope boundary, allowing script executed in the plugin context to affect the surrounding WordPress site and its users. User interaction is required, and the attacker must already hold elevated privileges within the WordPress instance.
Root Cause
The root cause is missing output encoding and insufficient input validation on survey-related fields handled by the plugin. Data written by privileged users is stored and later reflected into HTML responses without contextual escaping, violating the guidance codified in CWE-79.
Attack Vector
The attack path is network-based and requires an authenticated administrator or equivalent high-privilege user to submit a survey field containing an XSS payload. Once stored, the payload executes when a targeted user with an active session opens the rendered page. Refer to the Patchstack XSS Vulnerability Report for the technical writeup and impact description.
Detection Methods for CVE-2025-28878
Indicators of Compromise
- Survey configuration or question fields containing <script>, onerror=, onload=, or javascript: sequences in the WordPress database.
- Unexpected outbound requests from browser sessions after visiting pages that render Awesome Surveys content.
- New or modified WordPress administrator accounts following visits to survey pages.
Detection Strategies
- Query the wp_options and plugin-specific tables for stored survey content matching HTML event handler or script tag patterns.
- Review web server access logs for POST requests to Awesome Surveys endpoints containing URL-encoded angle brackets or common XSS payload markers.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from survey pages.
Monitoring Recommendations
- Alert on unauthenticated cookie exfiltration attempts and anomalous document.cookie access from browser telemetry.
- Monitor WordPress audit logs for high-privilege accounts editing or creating survey content outside expected change windows.
- Track plugin version inventory across managed WordPress installations to identify hosts still running Awesome Surveys 2.0.10 or earlier.
How to Mitigate CVE-2025-28878
Immediate Actions Required
- Identify all WordPress sites running Awesome Surveys and confirm the installed plugin version.
- Deactivate the Awesome Surveys plugin on affected sites until a patched release is confirmed and applied.
- Audit stored survey content for existing script payloads and remove any suspicious entries.
- Rotate administrator credentials and invalidate active sessions if compromise is suspected.
Patch Information
At the time of publication, no vendor-supplied fixed version is listed in the NVD entry for versions beyond 2.0.10. Monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release, and apply it as soon as it becomes available.
Workarounds
- Restrict access to WordPress administrator roles and enforce multi-factor authentication to reduce the pool of accounts capable of exploiting the flaw.
- Deploy a web application firewall rule to block requests to Awesome Surveys endpoints containing script tags or common XSS payload patterns.
- Apply a strict Content Security Policy that disallows inline scripts on pages rendering survey content.
- Remove the plugin entirely if surveys are not a required feature of the site.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.