The SurveyJS plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'id' parameter. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the injected page. This vulnerability is tracked as CVE-2025-3815 and is classified under CWE-79. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the low level, no user interaction needed, and a scope change with limited confidentiality and integrity impact but no availability impact. The plugin versions up to 1.12.32 are affected. No patch or official remediation has been documented yet.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject and execute arbitrary scripts in the context of other users accessing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. There is no impact on availability. The vulnerability does not currently have known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider additional input validation or web application firewall rules to detect and block malicious payloads targeting the 'id' parameter. Monitor vendor channels for updates and apply patches promptly once available.