SurveyJS Drag & Drop WordPress Form Builder Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the SurveyJS: Drag & Drop WordPress Form Builder plugin, affecting all versions through 1.12.20. The vulnerability arises from a lack of nonce validation on the SurveyJS_AddSurvey AJAX action, allowing unauthenticated attackers to create surveys by sending forged requests, provided they can manipulate a site administrator into clicking a link.
Impact
Exploitation of this vulnerability could lead to unauthorized survey creation on behalf of a site administrator.
Added: Jan 24, 2026, 9:33 AM
Updated: Jan 24, 2026, 9:33 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
6.9remediation
0.0relevance
2.2threat
3.2urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.