SurveyJS: Drag & Drop Form Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   SurveyJS: Drag & Drop Form Builder

Information

Software Type Plugin
Software Slug surveyjs (view on wordpress.org)
Software Status Active
Software Author devsoftbaltic
Software Website wordpress.org
Software Downloads 15,497
Software Active Installs 500
Software Record Last Updated August 19, 2026

10 Vulnerabilities

Submit a Vulnerability
SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-2440
Mar 20, 2026
Researcher: Daniel Basta (whizzu)
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
4.3
CVE-2025-13205
Jan 23, 2026
Researcher: Muhammad Nur Ibnu Hubab
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
4.3
CVE-2025-13194
Jan 23, 2026
Researcher: Muhammad Nur Ibnu Hubab
SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation
4.3
CVE-2025-13139
Jan 23, 2026
Researcher: Muhammad Nur Ibnu Hubab
SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion
4.3
CVE-2025-13140
Dec 1, 2025
Researcher: Muhammad Nur Ibnu Hubab
SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
CVE-2025-3815
May 2, 2025
Researcher: Peter Thaleikis
SurveyJS <= 1.12.20 - Missing Authorization
5.3
CVE-2025-32256
Apr 4, 2025
Researcher: Kévin Mosbahi (Mika)
SurveyJS <= 1.12.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-32167
Apr 4, 2025
Researcher: theviper17y
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile
8.8
CVE-2024-12544
Feb 28, 2025
Researcher: Thanh Nam Tran
SurveyJS: Drag & Drop WordPress Form Builder <= 1.9.136 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2024-50427
Oct 24, 2024
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting Unpatched CVE-2026-2440 7.2 Daniel Basta (whizzu) March 20, 2026
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning Patched CVE-2025-13205 4.3 Muhammad Nur Ibnu Hubab January 23, 2026
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming Patched CVE-2025-13194 4.3 Muhammad Nur Ibnu Hubab January 23, 2026
SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation Patched CVE-2025-13139 4.3 Muhammad Nur Ibnu Hubab January 23, 2026
SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion Patched CVE-2025-13140 4.3 Muhammad Nur Ibnu Hubab December 1, 2025
SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Patched CVE-2025-3815 6.4 Peter Thaleikis May 2, 2025
SurveyJS <= 1.12.20 - Missing Authorization Patched CVE-2025-32256 5.3 Kévin Mosbahi (Mika) April 4, 2025
SurveyJS <= 1.12.20 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-32167 6.4 theviper17y April 4, 2025
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile Patched CVE-2024-12544 8.8 Thanh Nam Tran February 28, 2025
SurveyJS: Drag & Drop WordPress Form Builder <= 1.9.136 - Authenticated (Subscriber+) Arbitrary File Upload Patched CVE-2024-50427 8.8 stealthcopter October 24, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation