CVE-2025-32167 Overview
CVE-2025-32167 is a stored Cross-Site Scripting (XSS) vulnerability in the devsoftbaltic SurveyJS plugin for WordPress. The flaw affects all versions of SurveyJS from initial release through 1.12.20. Attackers with low-privileged authenticated access can inject persistent JavaScript payloads that execute in the context of other users' browsers when they view affected survey content.
The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. It carries a scope-changed impact, meaning injected scripts can affect resources beyond the vulnerable component itself.
Critical Impact
Authenticated attackers can store malicious JavaScript that executes in victim browsers, enabling session theft, credential harvesting, and administrative account takeover through the WordPress admin interface.
Affected Products
- devsoftbaltic SurveyJS WordPress plugin versions up to and including 1.12.20
- WordPress sites with the SurveyJS plugin installed and active
- All SurveyJS-embedded survey forms rendering user-supplied content
Discovery Timeline
- 2025-04-04 - CVE-2025-32167 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32167
Vulnerability Analysis
The SurveyJS plugin fails to properly neutralize user-controllable input before embedding it into web pages served to other users. An authenticated attacker with contributor-level or similar privileges can inject arbitrary HTML and JavaScript into survey fields, titles, or configuration parameters processed by the plugin.
Because the payload is stored server-side, it executes automatically whenever a victim, including administrators, renders the affected page. The scope-changed nature of the flaw allows injected scripts to reach browser contexts and resources controlled outside the vulnerable plugin boundary.
Root Cause
The root cause is missing or insufficient output encoding when the plugin renders survey data. User input passes through storage and back into the DOM without HTML entity encoding or contextual sanitization. Any script tags, event handlers, or JavaScript URIs supplied by an attacker are preserved verbatim in the response.
Attack Vector
The attack requires network access to the WordPress site and a low-privileged authenticated account. User interaction is required, typically a victim visiting a page that renders the tainted survey content. Successful exploitation delivers stored payloads that persist across sessions until the malicious data is removed.
Refer to the Patchstack XSS Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-32167
Indicators of Compromise
- Unexpected <script> tags, onerror, onload, or javascript: handlers stored in SurveyJS-related WordPress database tables
- Outbound browser requests from admin sessions to unfamiliar domains after viewing surveys
- New administrator accounts or modified user roles following an authenticated user visiting a survey page
- Anomalous cookie exfiltration patterns or session token reuse from unexpected IP addresses
Detection Strategies
- Query the WordPress wp_posts and plugin-specific tables for stored HTML markup containing script tags or JavaScript event handlers within SurveyJS fields
- Monitor web server logs for POST requests to SurveyJS endpoints containing URL-encoded <script> or %3Cscript%3E patterns
- Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from survey pages
Monitoring Recommendations
- Enable WordPress audit logging to track content edits performed by contributor and editor accounts
- Alert on privilege changes, plugin installations, or theme modifications following survey rendering events
- Correlate authentication anomalies with visits to pages hosting SurveyJS embeds
How to Mitigate CVE-2025-32167
Immediate Actions Required
- Update the SurveyJS plugin to a version later than 1.12.20 once the vendor publishes a fixed release
- Audit all existing survey content for injected HTML or JavaScript and remove any suspicious entries
- Restrict contributor and editor account creation and review the current low-privileged user inventory
Patch Information
At the time of NVD publication, the advisory indicates the vulnerability affects SurveyJS through version 1.12.20. Administrators should consult the Patchstack advisory and the vendor's WordPress plugin page for the latest patched release before upgrading.
Workarounds
- Deactivate the SurveyJS plugin until a patched version is installed if surveys are non-essential
- Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers targeting SurveyJS endpoints
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendering user-generated survey content
- Limit the number of accounts with contribution privileges and require multi-factor authentication for all authenticated users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
