CVE-2025-3815: SurveyJS WordPress Plugin XSS Vulnerability

CVE-2025-3815 Overview

CVE-2025-3815 is a Stored Cross-Site Scripting (XSS) vulnerability in the SurveyJS plugin for WordPress. The flaw affects all versions up to and including 1.12.32. It stems from insufficient input sanitization and output escaping on the id parameter within the plugin's survey rendering logic. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any user who later views the affected page. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on May 3, 2025.

Critical Impact
Authenticated contributors can plant persistent JavaScript that runs against site visitors and administrators, enabling session theft, forced actions, and account takeover paths.

Affected Products

SurveyJS plugin for WordPress, all versions through 1.12.32
WordPress sites permitting Contributor-level (or higher) account registration
Any site rendering survey content produced by the vulnerable initializer.php code path

Discovery Timeline

2025-05-03 - CVE-2025-3815 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3815

Vulnerability Analysis

The SurveyJS plugin renders survey containers in the WordPress front end using a user-controlled id parameter. The plugin echoes this parameter into HTML attributes without escaping, allowing an attacker to break out of the attribute context and inject script content. Because the payload is stored server-side and re-rendered every time a visitor loads the page, exploitation is persistent. The attack requires a Contributor account, which lowers the practical attack surface but does not eliminate it on sites that accept user submissions or self-registration. Successful exploitation impacts confidentiality and integrity of the browser session and crosses privilege boundaries when administrators view the page.

Root Cause

The root cause is missing output escaping in initializer.php where the $id variable is emitted directly into a divid attribute. WordPress provides esc_attr() for this exact purpose, and its absence lets attacker-controlled markup terminate the attribute and introduce inline event handlers or <script> tags. This is a textbook CWE-79 Improper Neutralization of Input During Web Page Generation defect.

Attack Vector

An attacker authenticates to WordPress with a Contributor or higher role and creates or edits content that embeds the SurveyJS shortcode with a crafted id value. The payload is stored in the database and served to every visitor of the page. Because the vulnerability changes scope (script executes in the site origin), the injected code can read cookies, issue authenticated requests, or modify the DOM against higher-privileged viewers.

php

// Patch from src/trunk/initializer.php
$uploadFileUri = add_query_arg(array('action' => 'SurveyJS_UploadFiles'), admin_url('admin-ajax.php'));
$deleteFileUri = add_query_arg(array('action' => 'SurveyJS_DeleteFile'), admin_url('admin-ajax.php'));
?>
-        <div class="wp-sjs-plugin" id="surveyContainer-<?php echo $id ?>">
+        <div class="wp-sjs-plugin" id="surveyContainer-<?php echo esc_attr($id) ?>">
             <div id="surveyElement-<?php echo $id ?>">Survey is loading...</div>
             <div id="surveyResult-<?php echo $id ?>"></div>
         </div>

Source: GitHub Commit 6c33231. The fix wraps the $id output in esc_attr() to neutralize attribute-context injection.

Detection Methods for CVE-2025-3815

Indicators of Compromise

Post or page content containing SurveyJS shortcodes with unusual id values that include quotes, angle brackets, or on* event handler strings.
Rendered HTML where surveyContainer- is followed by broken attribute syntax or embedded <script> tags.
Unexpected outbound requests from browser sessions of administrators shortly after viewing pages that embed a SurveyJS widget.

Detection Strategies

Scan the wp_posts table for shortcode invocations referencing SurveyJS where the id attribute contains non-alphanumeric characters.
Review recent contributor-level content submissions in WordPress audit logs and correlate with pages that load the SurveyJS plugin.
Compare the installed plugin files against a known-good copy of a patched release listed in the SurveyJS Release Notes.

Monitoring Recommendations

Enable WordPress activity logging for post creation and edits by Contributor and Author roles.
Deploy Content Security Policy (CSP) headers that block inline script execution and report violations to a monitored endpoint.
Alert on browser console errors or CSP reports originating from pages that render SurveyJS content.

How to Mitigate CVE-2025-3815

Immediate Actions Required

Update the SurveyJS plugin to a version newer than 1.12.32 that includes commit 6c33231.
Audit all Contributor, Author, and Editor accounts and revoke unused or suspicious credentials.
Review pages containing SurveyJS shortcodes and remove any content authored by unverified users pending inspection.

Patch Information

The vendor addressed the flaw by applying esc_attr() to the $id variable in initializer.php. Refer to GitHub Commit 6c33231 for the code change and the Wordfence Vulnerability Analysis for advisory context. The current plugin source is maintained in the GitHub SurveyJS WordPress Repository.

Workarounds

Restrict user registration and limit Contributor role assignment until the patched plugin version is installed.
Deactivate the SurveyJS plugin on sites where surveys are not actively used.
Add a Web Application Firewall (WAF) rule that blocks SurveyJS shortcode submissions containing quote, angle-bracket, or event-handler payloads.

bash

# Example WP-CLI workflow to update the plugin and audit contributors
wp plugin update surveyjs
wp user list --role=contributor --fields=ID,user_login,user_registered
wp post list --post_status=any --s='[surveyjs' --fields=ID,post_author,post_date