CVE-2026-1901 Overview
CVE-2026-1901 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the QuestionPro Surveys plugin for WordPress in all versions up to and including 1.0. The flaw exists in the questionpro shortcode handler, which fails to sanitize user-supplied attributes and does not escape output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page, including administrators.
Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative action forgery, and site defacement against any visitor.
Affected Products
- QuestionPro Surveys plugin for WordPress, versions up to and including 1.0
- WordPress sites permitting Contributor-level or higher accounts that use the questionpro shortcode
- All deployments referencing the vulnerable shortcode handler in index.php
Discovery Timeline
- 2026-02-14 - CVE-2026-1901 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1901
Vulnerability Analysis
The QuestionPro Surveys plugin registers a WordPress shortcode named questionpro. When WordPress renders post or page content that includes this shortcode, the plugin reads attributes supplied by the content author and embeds them into HTML output. The plugin does not apply input sanitization functions such as sanitize_text_field() and does not call output escaping functions such as esc_attr() or esc_html() on those attributes. As a result, attacker-controlled values flow directly into the rendered DOM as executable HTML and JavaScript.
Stored XSS in this context persists across page loads because shortcode attributes are saved with the post content in the WordPress database. Every subsequent view of the affected post triggers script execution in the visitor's browser session.
Root Cause
The root cause is insufficient input sanitization and missing output escaping on shortcode attribute values processed by the plugin's shortcode callback in index.php at the referenced source line. WordPress provides escaping APIs for exactly this scenario, but the plugin omits them.
Attack Vector
Exploitation requires an authenticated session with at least Contributor privileges. The attacker creates or edits a post containing the questionpro shortcode and supplies a malicious attribute value containing an HTML event handler or <script> payload. When an administrator or visitor previews or publishes the page, the payload executes under the site origin. Because the scope is changed (CVSS S:C), the injected script can affect components beyond the vulnerable plugin, including the WordPress admin context.
No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Trunk Browsing reference for the affected source location.
Detection Methods for CVE-2026-1901
Indicators of Compromise
- Post or page content containing [questionpro ...] shortcodes with attribute values that include <script, onerror=, onload=, or javascript: substrings
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after rendering posts containing the shortcode
- New or modified posts authored by Contributor-level accounts that embed the questionpro shortcode
Detection Strategies
- Query the wp_posts table for post_content matching the questionpro shortcode and inspect attribute values for HTML or JavaScript syntax
- Deploy a Web Application Firewall (WAF) rule that flags shortcode attributes containing reserved HTML characters such as <, >, and " followed by event handler names
- Review WordPress audit logs for Contributor accounts performing repeated edits to posts containing shortcodes
Monitoring Recommendations
- Alert on Content-Security-Policy violation reports originating from WordPress page contexts
- Monitor admin sessions for anomalous actions performed immediately after viewing pages authored by lower-privileged users
- Track plugin file integrity for questionpro-surveys/index.php to detect tampering or regression
How to Mitigate CVE-2026-1901
Immediate Actions Required
- Deactivate and remove the QuestionPro Surveys plugin until a patched release is available, since all versions through 1.0 are affected
- Audit existing posts and pages for the questionpro shortcode and remove any entries containing suspicious attribute values
- Restrict Contributor-level account creation and review existing low-privileged accounts for legitimacy
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Monitor the Wordfence Vulnerability Report and the WordPress Plugin Tag Browsing page for an updated release beyond version 1.0.
Workarounds
- Remove the plugin entirely if the survey functionality is not business-critical
- Enforce a strict Content-Security-Policy header that disallows inline script execution on WordPress pages
- Limit shortcode usage to Editor and Administrator roles by filtering do_shortcode calls or using a role-management plugin
- Apply a WAF rule that strips HTML metacharacters from questionpro shortcode attributes at the edge
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate questionpro-surveys
wp plugin delete questionpro-surveys
# Example: search the database for shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[questionpro%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
