What is the CVSS score of CVE-2026-2440?

CVE-2026-2440 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2440?

WordPress sites using the SurveyJS plugin (versions up to 2.5.3) are vulnerable to stored cross-site scripting attacks that can compromise administrator accounts and sensitive data.

How to fix or mitigate CVE-2026-2440?

Within 24 hours: Audit all WordPress installations for SurveyJS plugin presence and version; disable the plugin immediately if installed. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious payloads in survey submissions; review admin access logs for suspicious activity. Within 30 days: Monitor vendor for patch release; evaluate alternative survey solutions or apply patch when available; conduct security awareness training for administrators on XSS risks.

WordPress CVE-2026-2440

EUVD-2026-14014 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-v39q-6w5w-5842

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14014

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 7.2

DescriptionCVE.org

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions. This is due to insufficient input sanitization and output escaping. The public survey page exposes the nonce required for submission, allowing unauthenticated attackers to submit HTML-encoded payloads that are decoded and rendered as executable HTML when an administrator views survey results, leading to stored XSS in the admin context.

AnalysisAI

The SurveyJS WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to and including 2.5.3. Unauthenticated attackers can submit malicious HTML-encoded payloads through public survey forms that execute when administrators view survey results in the WordPress admin dashboard. With a CVSS score of 7.2 and no authentication required, this represents a significant risk to WordPress sites using this plugin.

Technical ContextAI

This vulnerability affects the SurveyJS Drag & Drop Form Builder plugin for WordPress (CPE: cpe:2.3:a:devsoftbaltic:surveyjs:_drag_&_drop_form_builder). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability stems from inadequate input sanitization in the save_result.php file and insufficient output escaping in results.php when rendering survey submissions. The public survey page exposes WordPress nonces that should protect against unauthorized submissions, effectively bypassing CSRF protections and allowing arbitrary users to inject malicious content. HTML-encoded payloads are stored in the database, then decoded and rendered without proper sanitization when viewed in the admin context.

RemediationAI

Upgrade the SurveyJS plugin to version 2.5.4 or later when available, monitoring the official WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/08264ef7-940f-46b6-9880-34d730adad3c?source=cve for patch release notifications. Until patching is completed, consider temporarily disabling the SurveyJS plugin if not critical for operations, or restricting survey submission functionality by implementing IP-based access controls at the web server or firewall level to limit survey access to trusted networks only. Additionally, implement Content Security Policy (CSP) headers to mitigate XSS impact, and review existing survey results for suspicious content before viewing them in the admin dashboard.