CVE-2025-13194mediumCWE-352

CVE-2025-13194: falha de média gravidade em devsoftbaltic SurveyJS: Drag & Drop Form Builder

SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SurveyJS: Drag & Drop Form Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce verification on the 'SurveyJS_RenameSurvey' AJAX action. This makes it possible for unauthenticated attackers to rename surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
devsoftbaltic · SurveyJS: Drag & Drop Form Builder
CVEs relacionadas — devsoftbaltic SurveyJS: Drag & Drop Form Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2024-12544HIGHSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFileEPSS 0.8%CVE-2025-3815MEDIUMSurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2026-2440HIGHSurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-13140MEDIUMSurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey DeletionEPSS 0.2%CVE-2025-13139MEDIUMSurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey CreationEPSS 0.2%CVE-2025-13205MEDIUMSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey CloningEPSS 0.1%