CVE-2026-1901: QuestionPro Surveys Plugin XSS Vulnerability

CVE-2026-1901 Overview

The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the questionpro shortcode in all versions up to, and including, version 1.0. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or defacement of WordPress sites using this plugin.

Affected Products

• QuestionPro Surveys WordPress Plugin version 1.0 and earlier
• WordPress sites with Contributor-level user access enabled

Discovery Timeline

• 2026-02-14 - CVE-2026-1901 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1901

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the QuestionPro Surveys WordPress plugin due to improper handling of user-supplied input within the questionpro shortcode functionality. When a user with Contributor privileges or higher creates or edits content containing this shortcode, the plugin fails to adequately sanitize and escape attribute values before rendering them in the page output.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents one of the most common web application security flaws. Unlike reflected XSS attacks, stored XSS payloads persist within the application's database, causing the malicious script to execute every time a victim views the affected page.

The attack requires network access and authenticated user privileges (Contributor-level or above), but once the payload is stored, no further user interaction is required beyond viewing the compromised page. The scope is changed, meaning the vulnerable component can impact resources beyond its security scope—specifically, the injected scripts run in the context of other authenticated users' sessions.

Root Cause

The root cause of this vulnerability lies in insufficient input sanitization and output escaping within the plugin's shortcode handler at approximately line 31 of index.php. The plugin accepts user-controlled attributes for the questionpro shortcode but fails to properly validate, sanitize, or escape these values before incorporating them into the rendered HTML output. This allows attackers to break out of the expected attribute context and inject arbitrary JavaScript code.

Attack Vector

The attack is conducted over the network by an authenticated user with at least Contributor-level WordPress privileges. The attacker crafts a malicious post or page containing the questionpro shortcode with specially crafted attribute values containing JavaScript payloads. When published, the malicious script is stored in the WordPress database. Subsequently, any user who views the page—including administrators—will have the malicious script execute in their browser session.

The attacker could leverage this to steal session cookies, perform actions on behalf of the victim user, redirect users to malicious sites, or modify page content to display phishing forms. Since WordPress Contributors typically cannot publish posts directly, an editor or administrator must approve the content, though in some configurations posts may auto-publish.

The vulnerable code can be reviewed in the WordPress Plugin Code Review. Additional technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1901

Indicators of Compromise

• Suspicious posts or pages containing the questionpro shortcode with JavaScript event handlers or script tags in attribute values
• User reports of unexpected browser behavior when viewing specific pages
• Web application firewall (WAF) logs showing XSS patterns in POST requests to WordPress content creation endpoints
• Database entries in wp_posts table containing encoded script payloads within shortcode attributes

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for violation reports indicating script injection attempts
• Deploy a WordPress security plugin that scans for malicious shortcode content and XSS patterns
• Review WordPress audit logs for unusual content creation activity from Contributor-level accounts
• Use SentinelOne Singularity to detect anomalous browser-based activity indicative of XSS exploitation

Monitoring Recommendations

• Enable detailed logging for all post and page creation/modification events in WordPress
• Configure real-time alerts for content containing common XSS patterns (script tags, event handlers, JavaScript URIs)
• Monitor for unusual network requests originating from user browsers that may indicate exfiltration of session data
• Regularly audit user accounts with Contributor privileges and above for signs of compromise

How to Mitigate CVE-2026-1901

Immediate Actions Required

• Deactivate and remove the QuestionPro Surveys plugin until a patched version is available
• Review all existing posts and pages for malicious shortcode content and remove any suspicious entries
• Audit Contributor-level user accounts for any signs of malicious activity
• Implement a Web Application Firewall (WAF) with XSS protection rules

Patch Information

At the time of publication, no official patch has been confirmed. Organizations using this plugin should monitor the WordPress Plugin Development Version for updates and check the Wordfence Vulnerability Report for the latest remediation guidance.

Workarounds

• Disable the QuestionPro Surveys plugin entirely until a security update is released
• Restrict or remove Contributor-level access for untrusted users
• Implement strict Content Security Policy headers to prevent inline script execution
• Use WordPress security plugins that provide input sanitization and output escaping for shortcodes

# Configuration example - Add CSP headers in .htaccess or nginx config
# Apache .htaccess example
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Or disable the plugin via WP-CLI
wp plugin deactivate questionpro-surveys