The SurveyJS plugin for WordPress contains a critical stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute arbitrary code within the administrator dashboard.

The vulnerability exists due to insufficient input sanitization and output escaping when handling survey results. An unauthenticated attacker can submit crafted payloads that are later rendered as executable HTML when an administrator views the results within the plugin interface.

Successful exploitation of this flaw allows an unauthenticated attacker to inject malicious scripts into the WordPress administrative dashboard. Given the CVSS score of 7.2, this represents a significant risk, as it could lead to full administrative account takeover, unauthorized data modification, or the redirection of site traffic to malicious domains.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the SurveyJS plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress administrative activity logs for suspicious entries or unauthorized configuration changes that may indicate exploitation.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common XSS patterns and restrict access to the survey submission endpoints.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to the integrity of the WordPress administrative environment. Organizations currently utilizing the SurveyJS plugin should prioritize its immediate removal to prevent potential compromise. Security teams must monitor vendor communications closely for the release of a patched version before considering re-installation.