Threats tagged 'ghsa-r453-r877-6ghr'

SurveyKing versions 1.13.0 through 1.13.2 have a stored cross-site scripting (XSS) vulnerability. The server accepts respondent-supplied survey snapshots, and the frontend renders survey titles using innerHTML, allowing malicious scripts embedded in these snapshots to execute in an administrator's browser. This vulnerability can be triggered by anonymous respondents submitting crafted snapshots with event handlers like img onerror. The CVSS score is 6.1, indicating a medium severity impact.