Description

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:18.183Z",
  "pubdate": "2026-08-06T15:17:18.183Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Survey Maker plugin, specifically affecting versions 5.2.3.3 and prior. This security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable parameters processed by the application. When a victim interacts with the compromised survey components or views the rendered payload, the injected script executes within the context of their browser session.\nThe primary impact of this vulnerability includes session hijacking, unauthorized data access, defacement of the affected web application, and potential redirection to malicious external domains. Because the vulnerability requires no authentication or prior privileges, the attack surface is significantly broadened, exposing any deployment running the affected versions to automated or targeted exploitation over the network.\nRisk implications are severe for organizations relying on the Survey Maker plugin for user interaction, as successful exploitation undermines the integrity and confidentiality of user sessions interacting with the web application. Remediation requires updating the Survey Maker plugin to a patched version subsequent to 5.2.3.3 where input sanitization and output encoding controls are properly implemented.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Survey Maker plugin for versions <= 5.2.3.3. The root cause is characterized by insufficient input sanitization and a lack of proper context-aware output encoding on user-supplied parameters processed by the plugin. Specifically, data submitted via HTTP requests is accepted without adequate validation and subsequently reflected directly into the Document Object Model (DOM) during survey generation and rendering.\nExploitation of this flaw is achievable without authentication or elevated privileges, exposing the attack vector entirely over the network via standard HTTP/HTTPS requests. An attacker crafts a malicious URI or submits a specially crafted payload containing arbitrary JavaScript enclosed within HTML tags (e.g., <script> or event handlers like onload and onerror) into vulnerable input fields or parameters handled by the Survey Maker plugin.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies a vulnerable endpoint or parameter within the Survey Maker plugin. Second, the attacker constructs a malicious payload designed to execute arbitrary JavaScript in the browser of any user viewing the affected survey component. Third, the attacker delivers the payload to the target application, which stores or immediately reflects the unsanitized input without proper output encoding. Fourth, when a victim accesses the compromised survey page, the web browser receives the response containing the unescaped malicious payload. Finally, the browser parses the payload as executable script content, running it within the security context of the victim's session.\nThe behavior of the payload depends on the attacker's objectives, ranging from capturing session cookies and authentication tokens to performing unauthorized actions on behalf of the victim via the Document Object Model. Post-exploitation impact can lead to complete compromise of the victim's interaction with the affected site, potential privilege escalation if an administrative user views the payload, and unauthorized data exfiltration."
}