CVE-2025-13205: fallo de gravedad media en devsoftbaltic SurveyJS: Drag & Drop Form Builder
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.1%
The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This makes it possible for unauthenticated attackers to duplicate surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
devsoftbaltic · SurveyJS: Drag & Drop Form BuilderCVEs relacionadas — devsoftbaltic SurveyJS: Drag & Drop Form Builder
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-12544HIGHSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFileEPSS 0.8%CVE-2025-3815MEDIUMSurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2026-2440HIGHSurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-13140MEDIUMSurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey DeletionEPSS 0.2%CVE-2025-13194MEDIUMSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey RenamingEPSS 0.2%CVE-2025-13139MEDIUMSurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey CreationEPSS 0.2%