The SurveyJS plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). The public survey page exposes a nonce that allows unauthenticated attackers to submit HTML-encoded payloads as survey results. These payloads are not properly sanitized or escaped and are rendered as executable HTML in the admin interface when survey results are viewed. This enables stored cross-site scripting attacks in the administrator context, potentially allowing code execution or session hijacking. The vulnerability affects all versions up to and including 2.5.3. No patch or official fix information is provided in the available data.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts within survey results. These scripts execute in the context of an administrator viewing the results, potentially leading to session hijacking, privilege escalation, or other malicious actions limited to the admin context. The CVSS score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict access to survey result pages to trusted users only and consider disabling the plugin or survey result viewing functionality if possible. Input validation and output escaping should be implemented to prevent HTML-encoded payloads from being executed. Monitor vendor channels for updates or patches addressing this vulnerability.