Plugin icon

SurveyJS: Drag & Drop Form Builder

surveyjs

Vulnerabilities:

10

Last Updated:

March 20, 2026

Active Installs:

500

Published
Title
Fixed in
CVSS
Published
2026-03-20
Title
SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
7.2 (high)
Published
2026-01-23
Title
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity < 2.5.3 - Cross-Site Request Forgery to Survey Cloning
Fixed in
Fixed in 2.5.3
CVSS
4.3 (medium)
Published
2026-01-23
Title
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity < 2.5.3 - Cross-Site Request Forgery to Survey Renaming
Fixed in
Fixed in 2.5.3
CVSS
4.3 (medium)
Published
2026-01-23
Title
SurveyJS: Drag & Drop WordPress Form Builder < 2.5.3 - Cross-Site Request Forgery to Survey Creation
Fixed in
Fixed in 2.5.3
CVSS
4.3 (medium)
Published
2025-12-01
Title
SurveyJS: Drag & Drop WordPress Form Builder < 1.20.27 - Cross-Site Request Forgery to Survey Deletion
Fixed in
Fixed in 1.20.27
CVSS
4.3 (medium)
Published
2025-05-02
Title
SurveyJS < 1.12.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Fixed in
Fixed in 1.12.33
CVSS
6.4 (medium)
Published
2025-04-04
Title
SurveyJS < 1.12.57 - Contributor+ Stored XSS
Fixed in
Fixed in 1.12.57
CVSS
5.9 (medium)
Published
2025-04-04
Title
SurveyJS < 1.12.57 - Missing Authorization
Fixed in
Fixed in 1.12.57
CVSS
5.3 (medium)
Published
2025-02-28
Title
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity < 1.12.18 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile
Fixed in
Fixed in 1.12.18
CVSS
8.8 (high)
Published
2024-10-24
Title
SurveyJS: Drag & Drop WordPress Form Builder < 1.12.4 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 1.12.4
CVSS
8.8 (high)